Key Highlights:
- Suspicious on-chain outflows from CoinDCX sparked theft allegations after millions in USDT, including a single transfer of 15,819,002 $USDT, were consolidated into a Tron address.
- CoinDCX CEO Sumit Gupta dismissed the incident as a “false alarm,” stating that attackers from a prior $44 million July 2025 exploit are reusing abandoned exchange addresses.
- Independent blockchain investigator ZachXBT disputed Gupta’s defense, arguing that at least one flagged address, labeled TQKJQ, remained actively in use.
Suspicious Outflows Trigger Fresh Hack Concerns at CoinDCX
Fresh security concerns have emerged surrounding Indian cryptocurrency exchange CoinDCX following significant on-chain asset movements. Cryptocurrency exchanges typically assign every user a personal deposit address—a unique string of characters to send crypto to—before regularly executing sweeps. During these sweeps, the exchange transfers incoming funds into consolidated wallets under its direct control, distributing portions into internet-connected hot wallets for operational withdrawals and moving remaining balances into offline cold storage for safekeeping.
The latest alarm was raised by an observer named Darcy, who tracked an unusual sequence of transactions where multiple transfers were aggregated into a unified destination. All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 $USDT. Following the initial consolidation, that destination address proceeded to split the funds across several disparate wallets, mirroring transaction patterns frequently observed in unauthorized asset diversions.
Darcy’s post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange. The movement immediately put the platform under scrutiny, especially given its history of security breaches. CoinDCX was previously exploited in July 2025, an incident that resulted in a loss of roughly $44 million.
CoinDCX Leadership Responds as On-Chain Analysts Push Back
Following the public circulation of Darcy’s findings, CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm. In defending the exchange’s current operational security, CoinDCX maintained that the platform had fully abandoned those addresses in the aftermath of the previous security incident, asserting that the perpetrators of the earlier exploit are the entities still actively utilizing the wallets.
However, that explanation was swiftly contested within the blockchain forensics community. ZachXBT, a well-known on-chain investigator, challenged that claim. Scrutinizing the transactional history of the addresses involved, ZachXBT pointed out discrepancies in the timeline, stating that at least one of those addresses, labeled TQKJQ was still in use.
Why This Matters
Distinguishing between routine internal exchange rebalancing, attacker-driven money laundering, and active wallet mismanagement remains a vital challenge in blockchain transparency. When centralized platforms suffer major breaches—such as CoinDCX’s $44 million exploit in July 2025—the complete decommissioning and monitoring of compromised deposit architectures are critical to prevent further exposure. Conflicting accounts between executive leadership and prominent on-chain sleuths highlight the continued reliance of market participants on decentralized ledger forensics to verify exchange solvency and asset safety in real time.
Frequently Asked Questions
What caused the initial security alert regarding CoinDCX?
An on-chain observer named Darcy tracked large sweeps consolidating into a single Tron wallet—including a notable transfer of 15,819,002 $USDT—which then dispersed the capital across multiple wallets, raising suspicions of unauthorized fund drainage.
How did CoinDCX CEO Sumit Gupta explain the wallet activity?
Sumit Gupta stated that the activity was a false alarm caused by the July 2025 hackers reusing wallet addresses that the exchange had abandoned following the previous $44 million compromise.
Why did blockchain investigator ZachXBT dispute CoinDCX’s explanation?
ZachXBT challenged the claim that the addresses were completely abandoned, countering that on-chain records showed at least one of the implicated wallets, labeled TQKJQ, was still in active use.
