Indian cryptocurrency exchange CoinDCX has denied allegations of a second major security breach after blockchain investigators identified approximately $16 million in suspicious cryptocurrency transfers from addresses associated with the platform.
The disputed transactions occurred on October 21, 2026, involving approximately 15.99 million Tether (USDT) and 5,783.81 TRON (TRX) tokens. The transfers were initially flagged by blockchain investigator Darcy, who traced the assets from addresses identified as CoinDCX wallets to a receiving address on the TRON blockchain.
The funds were subsequently distributed across multiple addresses, with portions reportedly reaching accounts associated with Binance, OKX and Gate.
CoinDCX rejected suggestions that its current infrastructure had been compromised, maintaining that the flagged addresses were abandoned following a July 2025 attack that cost the company approximately $44.2 million.
However, additional blockchain analysis has challenged that explanation, leaving the status of the transferred funds unresolved.
Investigators Trace $15.99 Million Across 40 Wallets
The largest identified transaction involved approximately 15.82 million USDT transferred from a single address on October 21.
Blockchain intelligence company Bitquery subsequently examined activity across 40 TRON wallets linked to CoinDCX. Its October 22 investigation reported that approximately $15.99 million had moved through the addresses and that some wallets continued processing transactions after the July 2025 breach.
Bitquery identified 276 fee top-ups associated with deposit-processing activity since August 2026. The investigation also reported that one wallet was involved in routine activity approximately five minutes before the suspicious transfers began.
According to Bitquery, approximately $9.63 million reached deposit addresses associated with major cryptocurrency exchanges within 18 hours. Another $2.28 million remained in seven addresses identified by investigators as associated with the suspected recipient at the time of their October 22 assessment.
These findings challenge CoinDCX’s claim that the affected addresses had remained unused since July 2025. Nevertheless, blockchain transaction records alone cannot conclusively establish whether every transfer was unauthorized, identify the ultimate controller of each wallet or determine whether customer balances were affected.
CoinDCX Cites Previous Breach, Denies Customer Losses
CoinDCX co-founder and chief executive Sumit Gupta disputed the allegations, explaining that the flagged addresses had been compromised during the company’s July 2025 security incident. The exchange stated that the addresses were created in January 2025 and were no longer used for operational purposes.
It also maintained that customer funds remained secure and that trading and investment services continued normally. Blockchain investigator ZachXBT questioned that explanation, pointing to transaction activity involving addresses allegedly associated with customer deposits after the earlier breach.
The disagreement is significant because continued operational use would complicate the exchange’s account of how the addresses were managed following the incident. In July 2025, CoinDCX confirmed that attackers had compromised an internal operational account used for liquidity provisioning on a partner exchange.
The company estimated its exposure at approximately $44 million and said the loss would be absorbed through corporate treasury reserves. It maintained that customer assets held in segregated cold wallets were unaffected. The latest allegations have renewed scrutiny of the exchange’s wallet management, transaction monitoring and incident-response procedures.
However, the October transfers should not yet be added to the 2025 loss to claim a confirmed cumulative theft of approximately $60 million. Such a calculation would require evidence that the latest movements constitute a separate unauthorized loss.
The central unanswered questions concern ownership of the transferred assets, the operational status of the affected addresses and whether any customer liabilities remain outstanding. Until CoinDCX publishes a detailed reconciliation or independent investigators establish those facts, the reported $16 million incident remains disputed rather than a confirmed second hack.