Mentioned in This Article
1. What are the CoinDCX hack claims?
CoinDCX, which describes itself as India's leading cryptocurrency exchange, rejected allegations on October 22 that it had suffered a new security breach. The claims followed a report of roughly 16 million USDT and 5,783 TRX leaving addresses linked to the platform on October 21. The exchange said the addresses involved were old ones, created in January 2025, compromised in July 2025 and left unused since, and that customer funds were not affected.
The company's position is that the transfers have no connection to its current operations. In a statement posted on X, it said "Users' funds are safe" and described the claims circulating on the social platform about specific wallets and transactions as misleading. It added that trading and investing on the exchange were continuing as normal.
The episode revives attention on a platform that already went through a significant security incident last year. That background is a large part of why a report of unexplained stablecoin movements drew notice, even though the exchange maintains that the activity involved addresses it had stopped using.
A hot wallet is the type of address at issue in these claims, and a deposit address is one assigned to a customer so that the exchange can credit incoming funds. Both categories appeared in the original on-chain report, which is why the identity and history of each address became the central point of dispute between the analyst and the company.
2. What did the on-chain data show?
The transfers were first flagged by Darcy, an executive at the blockchain security firm Salus, who posted the details on X. According to that account, the transactions took place at 23:35:54 UTC+8 on October 21. Addresses identified as the exchange's hot wallet and a number of deposit addresses sent the assets to a single address on the TRON network.
The sums involved were about 16 million in Tether's USDT stablecoin, along with 5,783 TRX, the native token of the TRON blockchain. TRON is widely used for USDT transfers because fees are low and transactions settle quickly, which makes it a common route for moving large stablecoin balances between exchanges and wallets.
After the funds reached the receiving address, they were reportedly divided among multiple wallets. Some of the onward flows apparently arrived at deposit addresses linked to other exchanges, among them Binance, OKX and Gate. Splitting funds across many addresses and sending them to deposit addresses at several platforms is a pattern that tracing analysts often watch for, since it can make assets harder to follow.
Stablecoins such as USDT are issued by a company that can, in some circumstances, freeze tokens at specific addresses. That capability is one reason investigators track large stablecoin movements closely: if funds are tied to theft, the issuer and the receiving exchanges may be able to act on them.
3. How does CoinDCX explain the transfers?
In its response, CoinDCX repeated that the addresses were created in January 2025 and were compromised in July 2025. It said they had not been used since that point. By that account, whoever controlled the wallets at the time of the October 21 transfers was an unauthorized party that had held access since the earlier incident, rather than the exchange itself.
The company denied any link between the activity and its present operations. Its message to customers was that balances held on the platform were intact and that the movement of tokens from old, compromised addresses did not represent a fresh loss.
The explanation rests on the exchange's own description of those addresses, and the original report on the transfers came from an outside analyst. Readers following the matter should therefore distinguish between what the blockchain data shows, namely that tokens moved between identified addresses, and what the company says about the history and status of the wallets involved.
4. What happened in the July 2025 CoinDCX hack?
In July 2025, CoinDCX lost about $44 million in a hack that targeted an internal hot wallet used to provide liquidity on a partner exchange. A hot wallet is an address connected to the internet that holds funds for day-to-day operations, which makes it more exposed to attack than storage kept offline.
A CoinDCX software engineer was reportedly arrested shortly after the incident. The company did not publicly establish what role, if any, he played, so the circumstances of that arrest remain unclear from public information.
The company's current statement ties the October activity to that earlier compromise by pointing to the dates on which the addresses were created and compromised. If the exchange's account is accurate, the movement of funds would be a continuation of the aftermath of the 2025 theft and not a separate breach.
The earlier incident also shaped how the exchange approaches communication. After a breach, users tend to scrutinize every unusual transaction associated with a platform, and companies face pressure to clarify quickly whether a new event is a continuation of past losses or something entirely different.
5. Why do old compromised wallets matter?
When a wallet is compromised, whoever obtains its private keys can move its contents whenever they choose. Attackers do not always spend stolen assets right away; funds can sit untouched for months before being transferred, sometimes because the holders are waiting for attention to fade. A transfer from an address that was breached long ago is therefore not unusual in itself.
For an exchange, the key question is whether any of its active customer or reserve wallets were involved. Exchanges typically keep user deposits in wallets that are separate from operational accounts, and statements such as the one issued by CoinDCX are meant to reassure users that only the retired addresses were touched.
Because deposit addresses are issued to individual customers, their appearance in the transaction data requires an explanation of what they were and when they stopped being used. The company's description that the addresses were created in January 2025 and abandoned after the July compromise is the explanation it has offered.
Security specialists generally advise that once an address is known to be compromised, it should be retired and its remaining funds moved, so that a later transfer from it does not cause confusion. Clear internal records of retired addresses also make it easier for an exchange to answer questions when on-chain activity reappears.
6. How can users judge exchange security claims?
Public blockchains allow anyone to inspect transfers, but they do not reveal who controls an address or whether it belongs to an exchange. Labels come from analytics firms, security researchers and the exchanges themselves, and they can differ. That gap is why disputes of this kind often play out on social media, where researchers post transaction hashes and companies respond with statements.
Users can look for several signals when a claim of this sort appears: whether the platform has addressed it directly, whether withdrawals and trading remain available, whether it publishes proof-of-reserves information, and whether independent analysts confirm or contest the company's account. In this case, the exchange has said that trading and investing are working normally.
No independent confirmation of a new loss has been described in the available reporting, and CoinDCX has said that the funds in question did not come from customer balances. Until further details emerge, the situation stands as a disagreement over how to interpret the on-chain activity.
Independent verification is especially useful because the two sides in a dispute like this have different vantage points. Analysts see the public ledger but not an exchange's internal records, while the exchange sees its own address history but cannot prove a negative to outsiders without publishing supporting detail. Disclosure of that detail, where possible, is what usually ends such debates.
7. What is the significance for India's crypto market?
CoinDCX is one of the larger platforms serving Indian crypto users, so incidents involving it attract attention beyond the company itself. Trust is a central concern for exchanges operating in a market where regulation is still evolving, and any suggestion of security failure can prompt customers to reconsider where they hold assets.
The prompt public response suggests the company is aware of that sensitivity. By responding within a day of the transfers and stating that funds are safe, it aimed to prevent concern from spreading before the facts were established.
The broader lesson for the industry is that security does not end when an incident is resolved. Compromised addresses remain on the blockchain permanently, and any later movement from them will be visible and may be read as a new attack unless the exchange explains the context quickly.
Indian users have a range of platforms to choose from, and comparisons between them frequently turn on perceived safety. Statements, audits and transparency measures therefore carry commercial weight as well as reputational weight.
8. What happens next?
The main thing to watch is whether CoinDCX provides more detail about the affected addresses, such as how they were used before July 2025 and why deposit addresses were among those that sent funds. Further analysis from security researchers could also clarify where the tokens went after they reached the TRON address.
Anyone with funds on the platform can follow the company's official channels for updates. The exchange has said that no action is required from users and that its services remain available.
No timeline has been announced for a fuller explanation. For now, the facts that can be stated are that roughly 16 million USDT and 5,783 TRX moved on October 21, that CoinDCX attributes the addresses to the July 2025 compromise, and that the exchange says customer funds are safe.