On the evening of October 21, wallets that blockchain analytics firm Arkham and other trackers link to CoinDCX sent roughly $16 million — 15.82 million USDT and nearly 5,784 TRX — to a single Tron address. For India's largest crypto exchange by volume, the timing felt familiar: CoinDCX already lost $44 million from an internal liquidity account back in July 2025.
CEO Sumit Gupta pushed back almost immediately: "CoinDCX wallets are not breached. Please don't spread rumours. The addresses tagged by Arkham used to belong to CoinDCX before last year's hack, i.e. July 2025." According to the company, those addresses were created in January 2025, compromised that July, and never touched by the exchange since — meaning the funds that just moved were simply sitting in an abandoned wallet, not evidence of a fresh breach. "We assure that no user funds will be at loss," Gupta added.
On-chain investigator ZachXBT reads the same chain differently. He says one of those supposedly dormant addresses kept functioning as a deposit address for a third-party liquidity provider for ten months after the July incident, with activity recorded as late as April or May 2026 — and that the funds and fees it collected kept flowing into CoinDCX's current public hot wallet. If that holds up, the exchange's "abandoned wallet" story gets shaky: it would mean real customer deposits passed through a potentially compromised address for nearly a year.
Neither side has published a full paper trail yet, and the investigation is ongoing. But the dispute lands on a sore spot for Indian crypto: WazirX was hacked for $234 million in 2024, and now the country's second-largest exchange is explaining, for the second year running, why money is still moving out of "old" wallets. The takeaway for ordinary users is blunt — an address sitting on a proof-of-reserves list proves nothing if a company can't say exactly when, and why, it lost control of it.
