CoinDCX pledges no user losses after $16M transfers draw scrutiny

Analysts linked roughly $16 million in suspicious transfers to wallets labeled as belonging to CoinDCX. The issue matters because wallet activity can reveal whether an exchange truly stopped using addresses compromised in an earlier hack. CoinDCX denied a new breach and said the wallets had not been used since July 2025.

ZachXBT disputed that explanation. He said a CoinDCX deposit address remained in use by a liquidity provider for 10 months after the incident. The address allegedly transferred user deposits to CoinDCX’s current public hot wallet and received funds for transaction fees. Darcy also said two proof-of-reserves addresses sent funds to the flagged Tron address.

The transfers do not by themselves prove a new breach or customer loss. However, they created questions about wallet controls, address monitoring, and CoinDCX’s account of what happened after its $44 million hack. CEO Sumit Gupta said the company was investigating and assured users they would not lose funds.

The newly flagged transfers involved about $16 million. That is a substantial amount, but it is smaller than the $44 million CoinDCX said was drained during the July 2025 hack. Comparing the figures helps show the scale of the new concern without proving that the two events were directly connected.

The $16 million figure came from Darcy, who flagged transfers from addresses labeled as belonging to CoinDCX. The earlier $44 million figure refers to the exchange’s July loss. Investigators separately questioned whether wallets compromised in that hack continued to support exchange activity afterward.

CoinDCX said the wallets linked to the new transfers had been compromised in July and were no longer used. ZachXBT challenged that claim by pointing to continued activity involving a deposit address. The article does not establish that the $16 million was newly stolen, nor that customers lost money from these transfers.

A cryptocurrency wallet is software or hardware that lets a person or company control digital assets through cryptographic keys. The blockchain records transactions and addresses, while the wallet manages the keys needed to authorize transfers. Wallets matter because whoever controls the keys generally controls the assets.

A hot wallet is connected to the internet. Exchanges use hot wallets for faster deposits, withdrawals, and operating transfers, but that connection increases exposure to online attacks. A cold wallet is kept offline or separated from internet-connected systems. It is slower to use, but reduces the chance that a remote attacker can access the signing keys.

The article refers to CoinDCX’s current public hot wallet and to wallets compromised in July 2025. It does not describe the exchange’s full wallet architecture. The investigation therefore focuses on whether particular addresses stayed active, not on proving that every CoinDCX wallet was vulnerable.

CoinDCX said the flagged wallets were old addresses created in January 2025. The exchange said they were compromised in July 2025 and had not been used since. That explanation was meant to show that the new transfers did not represent a fresh security breach or current wallet activity by the exchange.

ZachXBT challenged the claim with a specific address. He said a CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July incident. According to him, it continued transferring user deposits to CoinDCX’s current public hot wallet and receiving funds to pay transaction fees.

Sumit Gupta acknowledged the issue and said CoinDCX was investigating further. The article does not report the investigation’s final findings. It does show that public blockchain activity contradicted, or at least complicated, the exchange’s statement that the affected wallets were no longer being used.

An active breach or mismanaged wallet could put customer deposits at risk. Possible consequences include unauthorized transfers, delayed withdrawals, frozen accounts, or uncertainty about whether the exchange can return assets. The seriousness depends on which keys or systems were exposed and whether the exchange can contain the problem.

The article gives two relevant facts. CoinDCX said customer wallets were separate from the account affected by the $44 million July 2025 drain. It also said it would cover that loss from its own treasury reserves. In the new dispute, CEO Sumit Gupta again assured users that no user funds would be at loss.

Those assurances do not settle what happened to the flagged transfers. CoinDCX said the wallets were old and no longer in use, while investigators cited later activity. The company said it would investigate and share an update. The article reports no confirmed customer loss from the newly flagged transactions.

Cryptocurrency exchanges generally separate customer assets from company operating funds through distinct wallets, accounts, records, and controls. The goal is to track what belongs to customers separately from money used for payroll, trading operations, fees, or reserves. Exact arrangements differ by exchange and are not detailed in the article.

This distinction mattered during CoinDCX’s July 2025 hack. The exchange said customer wallets were separate from the affected account. It also said the incident drained $44 million and that it would cover the loss from its own treasury reserves. That claim meant customers’ holdings were not supposed to bear the direct loss.

The later wallet dispute makes separation especially important. Investigators questioned whether an address associated with deposits remained linked to CoinDCX activity after the hack. If operational and customer flows are not clearly controlled, tracing responsibility becomes harder. CoinDCX denied a new breach and assured users that no funds would be lost.

Blockchain transactions create a public trail between wallet addresses. Investigators can inspect the sending address, receiving address, amount, timing, and later movements. Wallet addresses do not automatically reveal a person’s identity, but labels, exchange disclosures, and transaction patterns can connect an address to an organization.

That mechanism drove the CoinDCX scrutiny. ZachXBT identified activity involving a CoinDCX deposit address, a liquidity provider, and the exchange’s current public hot wallet. Darcy separately said two addresses listed in CoinDCX’s proof of reserves had transferred funds to the flagged Tron address. These links let investigators compare public movement with CoinDCX’s statements.

Proof of reserves can provide more addresses to monitor, but it does not by itself prove ownership, solvency, or wrongdoing. The article does not describe CoinDCX’s reporting method or confirm the investigators’ conclusions. It reports that CoinDCX was reviewing the issue and had not yet shared a final update.