CoinDCX Co-Founder Denies New Hack After $16 Million Wallet Alert
Published Updated 7 new reports since it was first published
CoinDCX rejected claims of a new security breach after on-chain alerts pointed to nearly $16 million in USDT moving from wallets linked to the exchange. Sumit Gupta said the addresses were tied to CoinDCX before its July 2025 hack, while new scrutiny over the wallet activity has kept the incident under review.
What this rests on
What it means
CoinDCX, India's largest crypto exchange, suffered a breach in July 2025 that drained funds from its wallets, one of several incidents that have hit Indian exchanges as trading volumes grew. On-chain sleuths and investigators like ZachXBT have since become a standard check on exchange disclosures, often surfacing wallet movements before companies confirm them publicly.
Users cannot independently verify which wallets are legacy, compromised addresses versus live operational funds, so they are left weighing a company statement against a researcher's on-chain flag. Traders watching the $15.99 million USDT movement must decide whether to treat CoinDCX's assets as secure or pull funds pre-emptively. Gupta's denial, if wrong, would delay withdrawals and recovery far longer than an early admission.
The dispute exposes a recurring trust gap: exchanges control the narrative on their own breaches, while independent investigators control the on-chain evidence, and the two accounts do not always match. When a company says old, compromised wallets explain fresh outflows, it is asking users to trust attribution they cannot audit themselves. That tension, not the dollar figure, is why unresolved wallet disputes damage confidence more than confirmed hacks sometimes do. (per crypto.news)
ZachXBT's challenge to CoinDCX's October 22 statement remains unanswered with on-chain specifics, and the TRON wallet analysis cited in follow-up reporting is the next thing to watch. Whether CoinDCX publishes a transaction-by-transaction reconciliation of the $16 million, or independent researchers produce contradicting proof of fresh compromise, will determine if this closes as a false alarm or reopens as a second breach.
Market reaction
How the story was built
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 2.6 years ago | Curio Ecosystem incident | $16M |
| 2.9 years ago | FloorProtocol incident | $16M |
| 5.0 years ago | Indexed Finance · Price manipulation incident | $16M |
| 6.1 years ago | Electrum incident | $16M |
| 7.8 years ago | Cryptopia incident | $16M |
4217 incidents stored · 250 were as large as this one or larger ($16M)