CoinDCX has acknowledged operational losses involving previously compromised deposit addresses after blockchain investigators flagged approximately $16 million in transfers linked to the Indian exchange.
The company said a process for moving deposits out of retired addresses had temporarily failed. It maintained that its active wallets were unaffected and that affected customers had received credits. The explanation followed public challenges to its initial denial of a fresh security incident.
Key Takeaways
- Investigators flagged approximately $16 million in transfers involving addresses associated with CoinDCX.
- The exchange attributed the activity to wallets compromised in July 2025.
- CoinDCX acknowledged a deposit-sweeping failure but denied a breach of its current wallets.
- The reported transfers should not automatically be treated as a confirmed $16 million loss to the company.
Investigators Challenge the Initial Explanation
The scrutiny began after investigator Darcy highlighted suspicious transfers involving USDT and TRX. CoinDCX initially said the flagged addresses had been compromised during its July 2025 hack and were no longer used by the exchange.
Blockchain investigator ZachXBT challenged that account. According to CoinDesk’s reporting, he identified an address that allegedly continued receiving deposits and transferring funds to CoinDCX’s current public hot wallet into 2026.
A blockchain explorer can show when funds moved and which addresses interacted. Establishing who controlled an address at a particular time, however, requires additional evidence. A historical exchange label alone cannot settle whether a transfer represents a new compromise.
CoinDCX Says Its Deposit-Sweeping Process Failed
In its subsequent explanation, CoinDCX said some customers continued sending funds to deprecated addresses despite earlier warnings.
The exchange normally moved those deposits to secure wallets through a process known as sweeping. It said that process failed for an unspecified period, causing losses that the company absorbed.
Cointelegraph’s updated report quoted the company’s assurance that affected deposits had been credited and customer assets remained in segregated cold wallets.
The distinction between hot and cold wallets helps explain the operational issue. Exchanges use different wallet arrangements for frequent transfers and longer-term custody. Protecting current storage does not, by itself, resolve deposits arriving at an older compromised address.
What Remains Unclear
The cited disclosures do not establish the precise operational loss, how long sweeping failed or how the acknowledged losses reconcile with the approximately $16 million flagged by investigators.
CoinDCX’s statements about customer credits and unaffected active wallets remain company representations. They should be distinguished from an independently verified accounting of the incident.
The case also highlights an often overlooked part of crypto wallet security: managing addresses after they are retired. Removing an address from an exchange interface does not prevent someone from sending funds to it on-chain.
Conclusion
CoinDCX’s explanation shifted the focus from an alleged new wallet breach to the handling of deposits sent to previously compromised addresses. A fuller incident report would need to establish the failure period, quantify the losses and explain how the affected deposits were reconciled.
