CoinDCX co-founder Sumit Gupta has denied a new security breach after an investigator flagged $15.99 million in USDT transfers from wallets linked to the Indian crypto exchange.
According to Darcy, funds moved from a reported CoinDCX hot wallet and several deposit addresses into a single address on the TRON blockchain. The largest transfer involved 15,819,002 USDT, worth approximately $15.82 million.
Tronscan records confirm that the transaction reached the receiving address at 11:35 a.m. ET on October 21. The address received approximately $15.99 million in USDT through 44 incoming transfers.
Darcy said the funds later passed through several wallets before reaching deposit addresses linked to Binance, OKX, Gate, and other exchanges. The movement raised concerns about a possible new theft.
However, Gupta disputed that interpretation. He said the flagged addresses belonged to CoinDCX before its July 2025 security breach and were compromised during that incident.
Gupta Says Hackers Reused Wallets From 2025 Breach
Gupta responded to Darcy’s alert within three hours. He rejected the breach claim and challenged the investigator’s interpretation of the transactions.
“Thanks for highlighting, but this is incorrect, and CoinDCX wallets are not breached. Pls don’t spread rumours,” Gupta wrote on X.
He explained that Arkham Intelligence had labelled the flagged addresses as CoinDCX deposit addresses. However, Gupta said the exchange created those addresses in January 2025, before attackers compromised them in July.
According to Gupta, hackers may now be reusing those old addresses to move funds. He said CoinDCX checked its current central and user addresses after the alert.
Gupta reported that none of those current addresses had sent funds to the wallets flagged by Darcy. He also maintained that the latest transactions had not compromised customer funds.
To support his explanation, Gupta pointed to CoinDCX’s public proof-of-reserves page, which provides information about the exchange’s reserves and wallet addresses.
Meanwhile, blockchain records confirm that the flagged transfers occurred. Tronscan also shows subsequent outflows, including separate payments of 2 million and 3 million USDT.
However, these records do not establish who controlled the wallets when the transactions occurred. They also cannot confirm whether the transfers represented a new theft or activity involving addresses compromised in 2025.
CoinDCX Previously Lost $44 Million in a Hack
CoinDCX reported a security breach in July 2025 that caused losses of approximately $44.2 million. Its incident report said attackers breached a server and compromised an internal account used to provide liquidity on a partner exchange.
The company said its customer wallets remained separate from the affected account. It also pledged to cover the losses through its treasury reserves.
