CoinDCX denies a new hack after $16 million leaves wallets tagged to it, blaming addresses compromised in its 2025 breach, while ZachXBT says one address stayed in use for ten months

India's CoinDCX spent Thursday insisting it had not been hacked again. About $15.99 million in USDT, plus a small amount of TRX, moved out of wallets that analytics labels tie to the exchange late on October 21, Asian time, and were funnelled to a single Tron address, then split up, with some funds landing at deposit addresses on Binance, OKX, Gate and other exchanges, according to a researcher known as Darcy, BeInCrypto reported; Cointelegraph put the outflow at about $16 million. Darcy also claimed two addresses listed in CoinDCX's latest proof of reserves had sent funds to the flagged address, Cointelegraph reported.

CoinDCX replied within hours. Co-founder and CEO Sumit Gupta said on X that the wallets were generated in January 2025 and were compromised in the July 2025 attack that cost the exchange about $44 million, BeInCrypto reported; CoinDCX said on X it has not used them since, Cointelegraph reported. Gupta suggested the attackers are reusing them, and said a check of all its current central and user addresses found none had sent funds to the flagged addresses, BeInCrypto reported.

The blockchain investigator ZachXBT pushed back, saying a CoinDCX deposit address remained in use for ten months after the 2025 breach via a liquidity provider, sending user deposits on to the exchange's current hot wallet, Cointelegraph reported. Gupta said the company was aware and investigating. "We assure that no user funds will be at loss," he wrote, according to Cointelegraph.

What happens next: Gupta said an update would follow. After the 2025 breach it said it would cover the loss from its own treasury, Cointelegraph reported; ZachXBT's claim leaves open whether the flagged address was still handling the exchange's user deposits.