Stale wallets, fresh scrutiny: CoinDCX faces questions over $16M transfers

CoinDCX denied a new security breach on Thursday and pledged that no user funds would be lost after analysts flagged suspicious transfers of about $16 million tied to wallets associated with the Indian cryptocurrency exchange.

CoinDCX said the flagged transactions involved old wallets created in January 2025 that were “compromised in July 2025” and had not been used by the exchange since. The explanation was posted Thursday on X.

Blockchain investigator ZachXBT challenged that account, saying a CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July 2025 incident. He said the address continued transferring user deposits to CoinDCX’s current public hot wallet and receiving funds to cover transaction fees.

Sumit Gupta, CEO of CoinDCX, responded: “Yes, aware of that. We’re investigating it further, and will share an update soon,” and added: “We assure that no user funds will be at loss.” Earlier on Thursday, Darcy, co-founder of asset recovery platform FlashRescue, flagged about $16 million in transfers from addresses labeled as belonging to CoinDCX.

Darcy also claimed that two addresses listed in CoinDCX’s latest proof of reserves had transferred funds to the flagged Tron address. CoinDCX was drained for $44 million in July last year, when it said customer wallets were separate from the affected account and that it would cover the loss from its own treasury reserves. CoinDCX did not respond to Cointelegraph’s inquiry by publication.