Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators - Protos | Informed crypto news
On Thursday, blockchain investigator Darcy flagged suspicious movements totalling $16 million on addresses linked to CoinDCX, prompting a denial from the exchange’s co-founder.
CoinDCX co-founder Sumit Gupta thanked Darcy for flagging the issue but insisted the attribution was “incorrect,” urging the researcher “don’t spread rumours.”
don’t spread rumours
On-chain sleuths have since taken issue with CoinDCX’s statements, with “SpecterAnalyst” flatly accusing the firm and its co-founder of “lying.”
lying
Exchange's explanation
CoinDCX later stated that the transactions involved old wallet addresses created in January 2025, which were compromised in July 2025 and have not been used by the exchange since.
The exchange clarified that users continued to deposit funds into the compromised address, despite warnings, and carried out “regular sweeping… so the funds can be properly accounted for and secured.”
the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.
Sleuths' doubts
However, Darcy took issue with the claim that the wallets were not used by CoinDCX, pointing to gas distribution activities both before and after the July 2025 hack.
Darcy noted that some funds were sent to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” adding “please don’t dodge the issue.”
please don’t dodge the issue
Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques differ between today’s transfers and last year’s hack, implying different actors.
Well known blockchain sleuth ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” post-compromise, and sent funds to “your current public hot wallet” as recently as May 2026.
SomaXBT accused CoinDCX of having moved $70 million of a market maker’s funds via the supposedly deprecated address.
Signs of stolen funds
SpecterAnalyst described the typical signals that indicate outflows of stolen funds, noting a change in behaviour from the affected address.
The address previously sent funds to CoinDCX’s hot wallet, but suddenly swept funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.”
CoinDCX eventually recognised the funds as “some operational losses,” and insists the deposits were credited to user accounts, but does not explain how the $16 million went unaccounted for over such a long period.
Related
