India's Largest Exchange Denies Hack After Sleuths Pointed to $16 Million in Suspicious Outflows
CoinDCX denies its active wallets were hacked after blockchain investigators flagged $16 million in suspicious outflows. The exchange blames a temporary failure in its deposit cleanup process for operational losses.
Intelligence analysis by Gemini 2.5 Flash Lite
India's largest crypto exchange, CoinDCX, is refuting claims of a hack, stating that suspicious outflows totaling $16 million originated from old, compromised wallet addresses from a July 2025 incident. While the exchange attributes the issue to a temporary failure in its deposit reconciliation process, an investigator claims at least one of these 'deprecated' addresses remained activ…
Imagine a bank that used old safety deposit boxes that were broken into last year. Now, someone is putting money into those old boxes again, and the bank says it's not their fault because they stopped using them. But a detective says the bank is still collecting money from those old boxes and moving it to their new, safe ones, which is a bit messy and risky.
Analysis
CoinDCX's Defense
CoinDCX has firmly denied any compromise of its active wallets, asserting that the $16 million in suspicious outflows flagged by blockchain analysts originated from old wallet addresses that were compromised in a July 2025 hack. The exchange's spokesperson stated that these addresses have been inactive since the previous incident and have no connection to CoinDCX's current operations. This stance suggests that the activity observed is a continuation of the previous exploit, with malicious actors attempting to reuse compromised infrastructure. The exchange emphasized that its central and user-facing addresses remain secure, and no funds from active wallets have been lost.
Investigator's Counterclaim
However, the exchange's narrative has been challenged by on-chain investigator ZachXBT. He presented evidence suggesting that at least one of the flagged addresses, labeled TQKJQ, was still actively used by a liquidity provider (LP) for ten months after the July 2025 incident. According to ZachXBT, this address continued to receive user deposits and gas fees as recently as April and May 2026, subsequently sweeping these funds into CoinDCX's current public hot wallet. This contradicts CoinDCX's claim of the addresses being abandoned and implies a more persistent vulnerability or a failure in the exchange's internal controls for managing deprecated addresses.
Operational Losses and User Impact
CoinDCX acknowledged that a temporary failure in its process for moving deposits from retired addresses led to operational losses. The exchange stated that it absorbed these losses and credited affected users, indicating that while active wallets were not compromised, there was an internal process breakdown. The exchange explained that despite notifying users not to deposit to compromised addresses, some continued to do so. The sweeping mechanism, designed to consolidate such deposits into main wallets, failed for a period. This explanation frames the event as an operational mishap rather than a direct security breach of its active systems, though the distinction is blurred by the continued interaction with compromised addresses.
Key points
- CoinDCX denies its active wallets were hacked, attributing $16 million in suspicious outflows to old, compromised addresses from a July 2025 incident.
- Blockchain investigator ZachXBT claims at least one of these 'deprecated' addresses remained active and handled user deposits into 2026.
- The exchange admits to operational losses due to a temporary failure in its process for moving deposits from retired addresses.
- CoinDCX states it absorbed these losses and credited affected users, asserting its current wallets were not impacted.
- The incident raises concerns about the distinction between security breaches and operational failures in crypto exchanges.
If CoinDCX's explanation holds true and the issue was indeed an operational failure with compromised legacy addresses, the exchange can reassure users by demonstrating robust internal controls and swift remediation. This could reinforce confidence in their security protocols and their ability to manage past vulnerabilities effectively, preventing future incidents.
The continued interaction with compromised addresses, even if attributed to a deposit sweep failure, raises serious questions about CoinDCX's internal security practices and oversight. If these 'deprecated' addresses were indeed still handling user funds and interacting with active wallets, it suggests a significant lapse in risk management, potentially exposing the exchange and its users to greater threats.
