Cryptocurrency exchange from India, CoinDCX, has denied allegations of a fresh data breach that involved close to $16 million (roughly Rs. 151 crore) worth of cryptocurrency transfers, despite the blockchain researcher ZachXBT contesting the explanation provided by the firm about the unusual wallet transactions. In an October 22 statement, CoinDCX stated that the allegations circulating on X were misleading since the transactions were conducted using wallet addresses that were compromised during its security breach in July 2025. The exchange claimed that its customers’ money was still safe and that the addresses mentioned in the recent accusations were no longer in use in its current wallet network.
CoinDCX Attributes Suspicious Transfers to Wallets Compromised in July 2025
ZachXBT disputed the reasoning provided and stated that at least one address was still accepting deposits and working with CoinDCX’s hot wallets a few months after the previous hack. The dispute arose after allegations made by blockchain researcher Darcy, in which transactions worth about 15.99 million USDT and 5,783.81 TRX on the TRON blockchain were identified. As per Darcy, these strange transactions took place on October 21 at around 23:35 UTC+8, when the funds were shifted to a new TRON address from the wallets labeled as CoinDCX deposit and hot wallets.
According to the researcher, the biggest individual transaction was worth 15,819,002 USDT, while the address that received these funds then distributed them among different wallets. Darcy claims that some of the money made it to the deposit accounts on Binance, OKX, Gate, and many more cryptocurrency exchanges after going through many intermediary wallets. But the investigator did not find any proof that the transactions were unauthorised or that the recipient wallet addresses belong to the attacker.
In light of the accusations, CoinDCX co-founder and CEO Sumit Gupta denied claims that the exchange had faced another breach. “CoinDCX wallets are not breached,” Gupta wrote, encouraging users not to spread any rumors while the company investigated the transactions. According to Gupta, the addresses found by Arkham Intelligence were once owned by CoinDCX but were breached during the July 2025 attack.
Subsequently, ZachXBT raised queries regarding the exchanges’ accounts, based on transactions made through a deposit address known as TQKJQ on the TRON blockchain. The investigator argued that the address was in active use by the liquidity provider for about 10 months after the July 2025 event, despite the wallets being compromised according to CoinDCX.
ZachXBT claims that the wallet received payments and transactions up until the month of April and May 2026, where the payments were transferred to other wallets which were labeled to be hot wallets for CoinDCX. According to ZachXBT, the transactions did not fit with the claim from the firm that the addresses were abandoned wallets used by attackers.
