What Went Wrong With CoinDCX’s Compromised Wallets?
The controversy began when blockchain investigator Darcy, co-founder of asset recovery platform FlashRescue, identified approximately $16 million in transfers from addresses labeled as belonging to CoinDCX.The flagged activity included a transaction involving approximately 15.8 million USDT on the Tron network. The transfers prompted concerns that CoinDCX might have suffered another security breach.CoinDCX initially rejected that interpretation, explaining that the addresses had been created in January 2025 and compromised during the July 2025 attack. The exchange said those wallets had subsequently been retired from active use.Blockchain investigator ZachXBT challenged that explanation, identifying a deposit address beginning TQKJQ that allegedly continued operating for approximately 10 months after the original breach.According to the investigator, the address continued forwarding deposits to CoinDCX’s publicly identified hot wallet and receiving cryptocurrency to cover transaction fees as recently as April and May 2026.CoinDCX’s subsequent admission clarified that deposits had continued arriving at compromised addresses and that its fund-consolidation process had failed. However, the exchange has not published a complete reconciliation explaining the disputed transfers or the precise duration of the failure.
Investor Takeaway
Why Did the Original $44 Million Hack Matter?
The latest incident follows CoinDCX’s July 19, 2025 security breach, when attackers stole approximately $44 million from an operational account used for liquidity management.As FinanceFeeds reported at the time, CoinDCX said the affected account was separate from customer custody infrastructure and that the company would cover the losses using its treasury reserves.The investigation subsequently led to the arrest of a software engineer following allegations that attackers had obtained access through compromised credentials and malware. FinanceFeeds previously detailed the arrest and the suspected credential-compromise mechanism.CoinDCX also introduced a recovery bounty offering up to 25% of recovered assets to individuals or organizations helping trace the stolen funds.The new disclosure introduces a different operational problem. Even after the original breach was contained, deposits continued arriving at addresses that had previously been compromised.That created an ongoing exposure requiring the exchange to identify incoming transactions, secure accessible funds and maintain accurate customer balances.The failure of that process raises questions about how effectively compromised wallet infrastructure was isolated after the 2025 incident.
Investor Takeaway
Are CoinDCX Customer Funds at Risk?
CoinDCX said all deposits received through the compromised addresses had been credited to the relevant customer accounts. It also maintained that funds held in its current operational wallets had not been stolen.The company reported that trading and other platform operations were continuing normally.Nevertheless, customer balances being credited does not independently establish that the exchange successfully recovered the underlying cryptocurrency from compromised addresses.That distinction is important for evaluating whether CoinDCX has absorbed the entire exposure or whether additional liabilities could emerge from its transaction reconciliation.India’s cryptocurrency sector has previously faced similar questions about exchange solvency and customer protection. Following the $230 million-plus WazirX breach in 2024, the exchange encountered substantial restrictions on withdrawals and eventually pursued restructuring, as detailed in FinanceFeeds’ coverage of its withdrawal limitations.Unlike that incident, CoinDCX has not announced a customer asset shortfall or suspension of normal trading operations in connection with the October transfers.
What Must CoinDCX Disclose Next?
The most consequential unanswered question is the financial size of the newly acknowledged operational losses.CoinDCX has not specified how long its fund-consolidation process was inactive, how much cryptocurrency accumulated in compromised addresses during that period or how much it successfully recovered.A wallet-by-wallet reconciliation could establish whether the approximately $16 million flagged by investigators consists entirely of customer deposits, previously compromised assets or transfers with different economic ownership.The exchange’s next disclosures will also determine whether the failure was limited to legacy deposit processing or exposed weaknesses in its wider wallet-monitoring procedures.