CoinDCX pledges no user losses after $16M transfers draw scrutiny

The July 2025 Exploit

CoinDCX, a prominent Indian cryptocurrency exchange, is facing renewed scrutiny over its handling of a security incident that reportedly occurred in July 2025. The exchange had previously disclosed that certain wallets were compromised during this exploit, leading to a loss of $44 million. At the time, CoinDCX assured its users that their funds were segregated from the affected accounts and pledged to cover all losses from its own treasury reserves. This commitment was intended to mitigate user concerns and maintain confidence in the platform's ability to safeguard assets, even in the face of a significant security breach. The exchange's public stance was that these compromised wallets had been decommissioned and were no longer in use for operational purposes.

The initial incident and CoinDCX's response were critical in shaping public perception of its security posture. By taking responsibility and promising to absorb the financial impact, CoinDCX aimed to demonstrate a strong commitment to user protection. However, the recent developments suggest that the narrative surrounding the July 2025 exploit may be more complex than initially presented, raising questions about the thoroughness of the exchange's post-breach remediation efforts and its transparency with the public. The ongoing dispute highlights the challenges crypto exchanges face in managing security incidents and rebuilding trust.

ZachXBT's Contradiction

The exchange's claims regarding the disuse of compromised wallets have been directly challenged by blockchain investigator ZachXBT. According to ZachXBT, a specific CoinDCX deposit address, which was supposedly compromised in July 2025, remained actively linked to a liquidity provider for an additional ten months. This address was reportedly used to transfer user deposits to CoinDCX's current public hot wallet and also received funds to cover transaction fees, indicating continued operational involvement. This direct contradiction casts significant doubt on CoinDCX's assertion that the affected wallets were immediately taken out of service.

The implications of ZachXBT's findings are substantial, suggesting a potential lapse in CoinDCX's security protocols or a lack of complete transparency regarding the status of its compromised infrastructure. CoinDCX CEO Sumit Gupta acknowledged ZachXBT's claims, stating that the exchange is "investigating it further" and promising an update, along with an assurance that "no user funds will be at loss." This response indicates that the exchange is taking the allegations seriously, but the delay in identifying and addressing such a discrepancy raises concerns about internal oversight and the accuracy of its public statements.

Darcy's $16 Million Flag

Further compounding the issue, Darcy, co-founder of the asset recovery platform FlashRescue, initially brought attention to approximately $16 million in suspicious transfers. These transfers originated from addresses that Darcy identified as belonging to CoinDCX. More critically, Darcy also claimed that two specific addresses listed in CoinDCX’s most recent proof of reserves had transferred funds to the flagged Tron address. This connection to proof of reserves is particularly troubling, as these reserves are meant to demonstrate the exchange's solvency and the integrity of its user funds.

The flagging of these transfers and their alleged link to proof of reserves addresses intensifies the pressure on CoinDCX to provide a comprehensive explanation. Proof of reserves is a crucial mechanism for crypto exchanges to build and maintain user trust, offering verifiable evidence that they hold sufficient assets to cover customer liabilities. If addresses associated with these reserves are implicated in suspicious outflows from allegedly compromised wallets, it undermines the very purpose of such transparency initiatives. The incident underscores the critical need for robust internal controls and continuous monitoring within cryptocurrency exchanges to prevent and promptly address any potential security vulnerabilities or operational discrepancies.