CoinDCX Co-Founder Denies New Hack After $16 Million Wallet Alert

CoinDCX's July 2025 breach drained roughly $44 million from its hot wallets, pushing the exchange to retire the compromised deposit addresses and issue new ones to customers. The October alert concerned exactly those decommissioned wallets, not new infrastructure. Indian exchanges operate under FIU registration but no binding on-chain proof-of-reserves rule, so the first line of detection came from independent researchers like ZachXBT and Salus's Darcy rather than mandatory company disclosure.

Some customers kept sending USDT to the old deposit addresses months after migration, and the automated sweep meant to forward those funds to cold storage failed, letting a balance build until it was drained. CoinDCX says it will cover the full 15.99 million USDT from its own balance sheet, so account holders see no shortfall on their dashboards. Anyone who saved the pre-2025 deposit address or QR code now needs to delete it entirely.

The dispute over CoinDCX's management is really about the three-day gap between Sumit Gupta calling the reports a 'false alarm' and the exchange confirming the loss, not just about dead wallets receiving live funds. ZachXBT's call for users to withdraw everything treats that gap as a trust failure: an exchange unable to immediately say which of its own addresses are retired is asking depositors to take its word on custody.

Watch whether CoinDCX publishes a full technical audit of every retired wallet from the 2025 incident, since its combined disclosed losses across both episodes now approach $60 million. A public accounting of which addresses were truly decommissioned versus still reachable would settle whether this was an isolated sweep failure or a sign that other legacy infrastructure remains exposed.