CoinDCX has denied that its active wallets were hacked after blockchain observers identified roughly $16 million in outflows tied to addresses associated with the Indian crypto exchange. The company said the transactions involved old wallet addresses, not its current operational wallets, and maintained that user-facing funds in active addresses were not affected.

The exchange said the addresses in question were created in January 2025, compromised in July 2025, and later taken out of use. According to CoinDCX, a temporary breakdown in the process used to sweep deposits from those retired addresses led to operational losses, which the company said it absorbed after crediting affected users.

Outflows flagged on Tron-linked addresses

The issue drew attention after a user pointed to a large outflow from what was described as CoinDCX’s hot wallet along with several deposit addresses. The total flagged movement was about $16 million, consisting of USDT and the Tron network’s TRX token.

The funds were sent to a single Tron address and were then split across multiple wallets, according to the report. That pattern prompted scrutiny from onchain sleuths and raised questions about whether the exchange had suffered a fresh security breach.

CoinDCX says current wallets were not hit

In response, CoinDCX said the reported transfers did not come from wallets that are currently in use by the exchange. A spokesperson told CoinDesk that the transactions involved older wallet addresses created in January 2025 and compromised months later, in July 2025.

The company said those addresses have not been used by CoinDCX since and argued that the activity now being reported has no connection to its present wallet infrastructure. It also said its central wallets and user addresses currently in operation were not impacted, and that no CoinDCX funds from active wallets were compromised.

Broken sweep process blamed for the loss

CoinDCX acknowledged, however, that the incident did result in losses. The exchange said a temporary failure in its internal process for moving deposits out of retired addresses allowed the issue to surface as funds continued to pass through those wallets.

According to the company, users who deposited to the affected addresses were credited, while CoinDCX itself absorbed the resulting operational loss. That explanation places the problem not in an ongoing compromise of active wallets, but in an unsuccessful cleanup mechanism tied to addresses the company says it had already retired.

Dispute remains over later wallet activity

Even so, the exchange’s account has not closed the matter entirely. An investigator cited in the report said that at least one of the addresses continued to receive deposits and interact with a current CoinDCX wallet into 2026.

That detail appears to conflict with the company’s claim that the addresses had not been used since the 2025 compromise. Based on the information reported so far, CoinDCX’s position is that the exchange remains secure at the active-wallet level, while outside investigators are still questioning how isolated the old addresses really were from the current system.

What is confirmed so far

At this stage, the confirmed points are limited but significant: around $16 million in USDT and TRX was moved out from addresses linked to CoinDCX; the funds were consolidated into one Tron address before being dispersed; and CoinDCX says the losses came from retired addresses rather than from any breach of active wallets.

The next clearly established issue is whether the affected addresses were truly inactive after July 2025 or whether they continued to play some role in CoinDCX’s deposit flow into 2026. That distinction is likely to determine whether the event is viewed as an isolated operational failure or evidence of a wider wallet management problem.

Source: www.coindesk.com