False Alarm”: How the Blockchain Told a Different Story About CoinDCX’s $16 Million Loss

When a company says one thing and the blockchain says another, the blockchain usually turns out to be right. This week, India’s biggest crypto exchange learned that in public.

Here’s what happened, how the money moved, and what it means for anyone holding crypto in India.

The alert

It started with a post on X. Darcy, co-founder of the asset rescue service FlashRescue, reported that about 15.99 million USDT and 5,783.81 TRX had left CoinDCX’s hot wallet and a handful of deposit addresses, all going to a single address on the Tron blockchain. The largest single transfer was 15,819,002 USDT. That’s roughly $16 million, or about ₹130 crore, in one move.

The denial

CoinDCX responded quickly. Co-founder and CEO Sumit Gupta answered in less than three hours, saying the claim was incorrect and the exchange’s wallets had not been breached. He explained that the addresses had been compromised in July 2025 and suggested the hackers were simply reusing them, calling it a “false alarm.”

CoinDCX’s official account backed him up four minutes later. It called the claims misleading and said the exchange had not used those addresses since the July 2025 incident.

The explanation was simple: these were old wallets the exchange no longer controlled, so nothing new had been lost.

What the chain showed

The problem with that explanation was that blockchain records are public, and anyone can check them.

On-chain analyst ZachXBT was first to push back. He said one deposit address had been used by a liquidity provider for 10 months after the July 2025 incident, and that it was still moving user deposits into CoinDCX’s current hot wallet as recently as April and May 2026.

Blockchain intelligence firm Bitquery then looked at 40 Tron wallets linked to CoinDCX. It found 276 fee top-ups connected to deposit processing since August 2026. One wallet had carried out routine activity about five minutes before the suspicious transfers began.

Bitquery’s findings were specific. Every one of the 35 smaller deposit addresses the attacker drained had a deposit swept out by the exchange itself after September 1, 2026. Wallets labelled as CoinDCX treasury wallets had also sent 14,519 TRX to the fee wallet between April and August 2026. That contradicts the CEO’s statement that no current address had funded the flagged wallets.

In short, the “abandoned” wallets were still in use.

The admission

The story changed within hours. Gupta replied to ZachXBT saying the team was investigating and that no user funds would be lost. Later the same day, CoinDCX posted that its sweeping process had failed for a period and caused operational losses, which the exchange would absorb. That post didn’t give a number.

The full figure came on October 25. In a blog update, CoinDCX said an automated sweeping service, which moves funds between the exchange’s wallets, had failed for a period. As a result, user deposits had built up at an address the exchange no longer used, and 15.99 million USDT was lost. CoinDCX said the company had absorbed the loss and that all user funds remained safe in segregated cold wallets.

Where the money went

After landing in the attacker’s address, the funds were split and sent on to deposit addresses at Binance, OKX and Gate.

The attacker moved fast. According to Bitquery, about $9.63 million reached deposit addresses linked to major exchanges within 18 hours. Another $2.28 million was still sitting in seven addresses tied to the suspected recipient when Bitquery published its findings on October 22.

Some of it was recovered. ZachXBT said he helped freeze stolen crypto worth six figures on the exchange’s behalf.

This has happened before

This is CoinDCX’s second loss in about 15 months. The July 2025 hack cost the exchange about $44 million. Bengaluru police later said hackers posing as recruiters had tricked a CoinDCX software engineer into installing malware on a company laptop.

That tactic should sound familiar. Fake job offers aimed at developers were a central part of the campaigns covered in our investigation into North Korea’s 2026 crypto thefts.

What we still don’t know

To be fair, some questions are still open. Blockchain records alone can’t prove whether every transfer was unauthorized or who ultimately controls each wallet, and they can’t show whether customer balances were affected. CoinDCX has not yet published a full incident report, and its PR agency referred journalists to the blog post without answering follow-up questions.

What this means

For users: Always copy a fresh deposit address from the exchange app before every deposit. Don’t reuse old addresses from your history, because exchanges retire addresses and you can’t always tell when an address has become unsafe. In this case, some users kept sending crypto to the old addresses despite repeated warnings.

For exchanges: Retiring a wallet is not the same as switching it off. If funds can still arrive at an address, someone needs to keep watching it.

For India’s crypto industry: Transparency is no longer optional. Investigators on the other side of the world had worked out the story from public data within hours. Exchanges need to be able to see their own wallets at least as clearly as outsiders can.

The blockchain doesn’t do PR. It keeps a permanent public record, and that record is available to anyone who knows how to read it.

Nodestors maps wallet activity across chains and turns raw blockchain data into intelligence that investigators, compliance teams and exchanges can act on. Let’s connect.