CoinDCX Co-Founder Denies New Hack After $16 Million Wallet Alert

CoinDCX co-founder Sumit Gupta denied a new breach on Oct. 22 after an onchain investigator flagged roughly 15.99 million $USDT moving from wallets attributed to the Indian crypto exchange.

The disputed addresses belonged to CoinDCX before its July 2025 hack and were compromised in that incident, Gupta said on X. He said the exchange had checked its current central and user addresses and that none had sent funds to the flagged wallets. “None of the CoinDCX funds got compromised,” he wrote.

The transfers themselves are visible on TRON, including a single 15.82 million $USDT payment. But Gupta’s denial challenges the central premise of the alert: whether those movements represent a new loss for CoinDCX or its customers, rather than activity involving previously compromised addresses.

The alert came from Darcy, an investigator whose profile identifies him as a co-founder of asset-recovery service Flash Rescue. He described a suspected theft of about 15.99 million $USDT and 5,783.81 TRX from CoinDCX hot-wallet and deposit addresses on Oct. 21. He said the funds converged on TRON address `TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT`, then split through other wallets toward Binance, OKX and Gate deposit addresses.

Transfers Confirmed, Wallet Control Disputed

Tronscan records show a successful transfer of 15,819,002 $USDT to that address at 11:35 a.m. ET on Oct. 21 from `TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy`. Arkham labels the sender “CoinDCX Deposit Address.”

The recipient received approximately 15.99 million $USDT across 44 incoming transfers through that payment, according to The Defiant’s calculation from both pages of Tronscan records. The records also show subsequent outflows, including separate payments of 2 million and 3 million $USDT. Those transactions establish movement of funds, not who currently controls the sending wallets or whether a theft occurred.

Gupta said the old addresses appeared to be getting reused by hackers, calling the alert incorrect. He said the team was investigating further and that more details would follow from CoinDCX’s official channels.

CoinDCX previously disclosed a roughly $44 million breach in July 2025. In its incident report, the exchange said a server breach compromised an internal account used to supply liquidity on a partner exchange. It said customer wallets were separate and unaffected, and that its own treasury reserves would absorb the loss.