CoinDCX vows no user losses after $16M flagged transfers

Indian crypto exchange CoinDCX has denied suffering a new breach after about $16 million in transfers from addresses linked to it were flagged on Thursday, and its CEO says no user funds will be lost, Cointelegraph reported. On-chain investigators are questioning the exchange's explanation.

What was flagged

• Darcy, co-founder of asset-recovery platform FlashRescue, flagged roughly $16 million moving out of addresses labelled as belonging to CoinDCX.
• Darcy also said two addresses listed in CoinDCX's latest proof of reserves had sent funds to the same flagged Tron address.

CoinDCX's explanation — and the pushback

CoinDCX said on X that the transactions involved old wallets created in January 2025 that were "compromised in July 2025" and that it had not used since.

Blockchain sleuth ZachXBT disputed that timeline. He said a CoinDCX deposit address stayed in use by a liquidity provider for 10 months after the July 2025 incident, continuing to forward user deposits to the exchange's current public hot wallet and receiving funds to pay transaction fees.

CEO Sumit Gupta replied that the company was aware of the claim and investigating: "We assure that no user funds will be at loss." CoinDCX did not respond to Cointelegraph's request for comment before publication.

Why it matters

CoinDCX lost $44 million in a hack in July 2025. At the time it said customer wallets were kept separate from the affected account and that it would cover the loss from its own treasury reserves. If wallets it described as retired were still part of its deposit flow, users and analysts will want to know how its proof-of-reserves list and internal wallet controls line up.

The episode is a reminder of what custodial vs non-custodial storage means in practice: coins left on an exchange depend on its security and its promise to make users whole. Our guide on how to store crypto safely explains when it makes sense to move funds to a wallet you control.