Indian cryptocurrency exchange CoinDCX has denied reports of a new security breach involving approximately $16 million. The platform's co-founder, Sumit Gupta, stated that the suspicious transactions identified by security researchers involve wallet addresses compromised during a previous incident in July 2025.
The allegations originated from a post by a marketing director at Salus, who noted that nearly 16 million USDT and 5783.81 TRX were moved from addresses linked to the exchange to a TRON network address. These funds were subsequently distributed to deposit addresses on Binance, OKX, and Gate.
Gupta explained that the hackers are reusing old wallet addresses created in January 2025, which were compromised in the July 2025 attack. He asserted that current CoinDCX operational and user wallets remain secure and have not interacted with these addresses, adding that all company funds are accounted for.
However, on-chain investigator ZachXBT challenged this explanation. He claimed that one of the deposit addresses in question remained in use by a liquidity provider for 10 months following the July 2025 incident, continuing to process user deposits and gas fee transfers to the exchange's public hot wallet as recently as April and May 2026.
In the July 2025 incident, CoinDCX lost approximately $44.2 million due to a breach of an internal operational account. At that time, the company covered losses from its own reserves, and the attack was later linked by analysts to the Lazarus Group. Indian authorities also arrested an employee whose laptop was compromised by malware.
