CoinDCX tied the transfers to wallets compromised in July 2025, but investigators said the addresses remained linked to its operations.
Indian cryptocurrency exchange CoinDCX denied a new security breach after analysts flagged suspicious transfers, but investigators questioned its claim that it stopped using the wallets after a July 2025 hack.
The flagged transactions involved old wallets created in January 2025, which were “compromised in July 2025” and have not been used by the exchange since, CoinDCX said Thursday on X.
Blockchain investigator ZachXBT challenged that account, saying a CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July 2025 incident. He said the address continued transferring user deposits to CoinDCX’s current public hot wallet and receiving funds to cover transaction fees.
“Yes, aware of that. We’re investigating it further, and will share an update soon,” responded Sumit Gupta, CEO of CoinDCX. “We assure that no user funds will be at loss.”
Darcy, co-founder of asset recovery platform FlashRescue, earlier on Thursday flagged about $16 million in transfers from addresses labeled as belonging to CoinDCX.
Darcy also claimed that two addresses listed in CoinDCX’s latest proof of reserves had transferred funds to the flagged Tron address.
CoinDCX was drained for $44 million in July last year. The exchange said at the time that customer wallets were separate from the affected account and that it would cover the loss from its own treasury reserves.
CoinDCX did not respond to Cointelegraph’s inquiry by publication.
Related: HEX token sellers erase $160M following reports of Richard Heart’s arrest
Subscribe to daily byte-sized crypto news from Cointelegraph
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
More on the subject
