India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows

Every user gets a personal deposit address, a unique string of characters to send crypto to. The exchange then regularly "sweeps" those deposits, meaning it moves them into its own main wallets so everything sits in one place it controls. Some of that money goes to a hot wallet, an internet-connected place used for everyday withdrawals. The rest goes to cold wallets, which are kept offline.

All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 USDT. That address then split the money across several different wallets.

Darcy's post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange. CoinDCX was exploited before, in July 2025, for about $44 million.

CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm.

In other words, CoinDCX’s position is that the exchange abandoned those addresses after the hack and that the hackers are the ones still using them.

ZachXBT, a well-known on-chain investigator, challenged that claim. He said at least one of those addresses, labeled TQKJQ was still in use.