By Hamza Faisal

India's largest crypto exchange, CoinDCX, has admitted to "operational losses" after blockchain investigators flagged roughly $16 million in transfers from wallets linked to the platform, forcing the company to walk back its initial denial that the funds had anything to do with it.

The story began on Tuesday, when Darcy, an investigator at blockchain security firm Salus and co-founder of the asset recovery platform FlashRescue, flagged suspicious transfers from addresses labeled as belonging to CoinDCX. The transfers — about $16 million in USDT and TRX moved across the Tron network — immediately set off claims of a fresh hack.

CoinDCX's first response was a flat denial. In a statement on X, the exchange said the wallets had been created in January 2025 and compromised during its July 2025 security breach, and insisted it had not used them since. CEO Sumit Gupta suggested the movement was hackers reusing the old addresses — a false alarm, in his telling. "Trading & investing continue as usual," the company said.

Investigators punched holes in the denial

The denial did not survive contact with the on-chain data. Blockchain investigator ZachXBT challenged CoinDCX's account, saying a CoinDCX deposit address had remained in use by a liquidity provider for 10 months after the July 2025 incident — still routing user deposits into the exchange's current hot wallet. Darcy added that the flagged addresses showed gas distribution activity both before and after the breach, and that two addresses listed in CoinDCX's own proof of reserves had moved funds to the flagged Tron address. Some of the funds, Darcy said, ended up at addresses associated with Huione and Xinbi, known money-laundering guarantee services.

Former MetaMask security researcher Taylor Monahan noted that the laundering methods in the new transfers looked different from those used in last year's hack — suggesting different actors were at work.

Confronted with the pushback, CoinDCX changed its story on Thursday. The exchange admitted that some users had continued depositing crypto into the compromised addresses despite warnings to stop, and that it routinely sweeps such deposits out into secure systems. That sweeping process, the company said, had failed for an unspecified period.

"Operational losses" — but no user funds at risk

"This failure led to some operational losses, which were absorbed by CoinDCX," the exchange said. It added that all affected deposits had been credited to users' accounts, that no funds from active wallets had been compromised, and that customer assets remain in segregated cold wallets.

Gupta responded to ZachXBT directly: "Yes, aware of that. We're investigating it further, and will share an update soon. We assure that no user funds will be at loss."

The episode revives scrutiny of the July 2025 breach itself, in which CoinDCX was drained of $44 million after a software engineer's company laptop was compromised while he was doing side jobs. The exchange covered that loss from its own treasury. What investigators are asking now is why addresses tied to that incident were still collecting user deposits well over a year later — and why the exchange only acknowledged the gap after someone else traced it on-chain.

For users, CoinDCX's pledge is unambiguous: no user funds will be lost. For the exchange, the damage is of a different kind. Its first explanation was contradicted by the blockchain within hours; only the second one — the one it gave after being cornered — came with an admission.

By Hamza Faisal