On-chain data showed suspicious transactions from a wallet linked to the CoinCDX exchange. Over $15M in stablecoins were moved from the wallet, which was exposed in an earlier breach in 2025.
The Indian crypto exchange CoinCDX is in the midst of a theft investigation. On-chain data linked a sudden outflow of funds from a wallet previously known to belong to the exchange.
The exchange denies that the wallet is currently under its control, claiming it was falsely flagged on Arkham Intelligence.
‘The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm,’ explained on X the exchange’s co-founder Sumit Gupta.
The wallet transfers were noted late on October 21, moving $15.99M in USDT and 5,783.81 TRX. The funds were sent to an intermediary address, which was then emptied out, with some of the USDT reaching Binance hot wallets, as well as OKX and Gate.
CoinCDX wallet was still used in DeFi protocols
While CoinCDX denied using the wallet or controlling it, the address was still found to be active long after the 2025 exploit.
On-chain researcher ZachXBT noted the wallet has still been used as a liquidity provider, while also sweeping user deposits. Additionally, ZachXBT noted CoinCDX still has to account for around $15.8M in user funds not accounted for in a transparent proof of reserves.
As Cryptopolitan previously reported, CoinCDX has been flagged as an exchange used in fraud laundering. In 2025, the exchange also suffered a hack taking up to $44M.
The recent movement of funds may not represent another wallet theft, but actually show CoinCDX users still deposited to the wallet for at least 10 months after the 2025 hack. ZachXBT also discovered the current hot wallets still sent gas to the compromised address as late as April 2026.
CoinCDX is a relatively small exchange, with $1.15M in daily volume for the past 24 hours. The exchange’s most active pair is between fiat and USDT, with a limited number of assets offered. The exchange is seen as inherently risky, but now there are more doubts that the market operator may have failed to protect user funds, allowing deposits to refill an already compromised wallet.
Can the CoinCDX funds be salvaged?
In an unusual move, the funds from CoinCDX were moved to centralized exchanges. Most of the funds were also in USDT, meaning either Tether or the exchanges can freeze and revert the loss, but that depends on CoinCDX confirming the exploit.
The fund movements from the exploiter wallet also repeated the previous CoinCDX hack, where the funds were laundered through centralized markets.
Currently, CoinCDX is suspected of flawed security practices and of actually reusing its compromised wallets, while not giving sufficient proof of the safety of user funds. CoinCDX once again issued a statement that it did not interact with those wallets, going against the on-chain evidence.
The CoinCDX exposure is a relatively rare event, as most of the hacks are targeting decentralized protocols. The suspected exploit against CoinCDX arrives at a time when crypto users are becoming more wary of hacks and accidental exposure, including the compromised private keys through Railway and the potential effects of the newly discovered PHP vulnerabilities.
The CoinCDX exploit is still not fully understood, but if the exchange diverted user funds to a compromised address, it would further undermine trust in depositing crypto to exchange wallets.
On-chain research found additional links between the hacker’s wallets and addresses used by CoinCDX, as noted by @DarcyAri, the account that first noticed the suspicious transfers.
The smartest crypto minds already read our newsletter. Want in? Join them.