CoinDCX has denied recent claims of a $16 million hack, stating the transactions are linked to compromised wallets from July 2025.
Indian cryptocurrency exchange CoinDCX has refuted claims of a hacking incident involving approximately $16 million. Co-founder Sumit Gupta clarified that the suspicious transactions are linked to wallets compromised back in July 2025, not recent breaches.
"Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Please don’t spread rumours. The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm," Gupta stated on Twitter.
On October 22, the marketing director of Salus, known as Darcy, raised concerns about a potential hack involving CoinDCX. He reported that on the evening of October 21, approximately 15.99 million USDT and 5,783.81 TRX were transferred from a hot wallet and several deposit addresses associated with the exchange to a single address on the TRON network.
The largest transaction was noted to be 15.82 million USDT, with the recipient subsequently redistributing the assets among various wallets, including addresses on Binance, OKX, and Gate.
Despite these claims, Gupta dismissed the notion of a new attack, insisting that the wallets in question had not been used by CoinDCX since they were compromised over a year ago. He emphasized that all current operational and user wallets were secure and had not interacted with the old addresses.
"Users’ funds are safe. Claims circulating on X regarding certain wallet addresses and transactions are misleading. The transactions mentioned involve old wallet addresses created in January 2025 that have not been used by CoinDCX since July 2025," CoinDCX confirmed.
However, blockchain investigator ZachXBT expressed skepticism about Gupta's assertions, noting that one of the deposit addresses had continued to be used for transactions for several months after the initial hack.
Background on Previous Hack
In July 2025, CoinDCX suffered a significant breach, losing around $44.2 million when hackers accessed an internal operational account. This incident was first reported by ZachXBT, who noted that funds were withdrawn approximately 17 hours before the exchange publicly acknowledged the attack.
Gupta described the event as a sophisticated attack on the server infrastructure, assuring that client funds remained unaffected and that the exchange covered the losses from its reserves. Subsequent investigations linked the hack to the North Korean group Lazarus, highlighting similarities to prior attacks attributed to the hackers.
CoinDCX also initiated a reward program for information leading to the recovery of lost funds, offering participants up to 25% of the recovered amount.
