Blockchain sleuths accuse CoinDCX of lying over $16M hack

On Thursday morning, blockchain investigator Darcy flagged $16 million in suspicious movements on wallet addresses believed to be linked to crypto exchange CoinDCX.

Shortly after, CoinDCX co-founder Sumit Gupta thanked the researcher — an employee of security firm Salus — while insisting the attribution was “incorrect,” telling Darcy “don’t spread rumours.”

Several on-chain investigators have since disputed CoinDCX’s claims, with an analyst known as SpecterAnalyst directly accusing the exchange and its co-founder of “lying.”

10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX

CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX

其中最大单笔为 15,819,002…

— Darcy 资产救援 (@DarcyAri) October 22, 2026

CoinDCX calls claims “misleading”

In a later update on its official X handle, CoinDCX stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.”

Last year, CoinDCX suffered a $44 million hack when a software engineer’s company laptop was compromised during side gig work.

A second post contradicted CoinDCX’s initial statement, clarifying that users kept depositing funds into the compromised address despite warnings, and that the exchange carried out “regular sweeping… so the funds can be properly accounted for and secured.”

Further update on the TQKJQ wallet On-Chain activity.

Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been…

— CoinDCX (@CoinDCX) October 22, 2026

For a particular period, however, the sweeping process failed, and this only became known after Darcy’s post flagged the fund withdrawal.

CoinDCX later acknowledged the funds as “some operational losses,” and maintains that the deposits were credited to user accounts. The exchange does not provide details on how $16 million went unaccounted for over such a long time.

Protos contacted CoinDCX by email but had not received a reply at the time of publication.

Blockchain sleuths have their doubts

Gupta’s initial denial was challenged by Darcy, who took issue with the claim that the wallets were unused, highlighting gas distribution activities from before and after the July 2025 hack.

Darcy also noted that some funds were directed to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” and added “please don’t dodge the issue.”

Taylor Monahan, a former MetaMask security specialist, pointed out that the laundering methods used in today’s transfers differ from those in last year’s hack, suggesting different actors were involved.

Renowned blockchain investigator ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” after the compromise, and sent funds to “your current public hot wallet” as recently as May 2026.

Other pseudonymous investigators also chimed in. Tanuki42 highlighted CoinDCX’s contradictory communications, while SomaXBT accused the exchange of moving $70 million of a market maker’s funds through the supposedly deprecated address.

For those who don't know how to identify stolen funds, it's often pretty easy.

One way to identify a potentially compromised wallet is to look for a sudden change in its established transaction patterns.

For instance, TQKJQ, a CoinDCX deposit address, had consistently been… pic.twitter.com/215kRk3jbT

— Specter (@SpecterAnalyst) October 22, 2026

SpecterAnalyst’s earlier post describes the typical signs that indicate stolen fund outflows.

The post notes a change in behavior from the affected address: it previously sent funds to CoinDCX’s hot wallet, but suddenly started sweeping funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.”