Indian cryptocurrency exchange CoinDCX has confirmed that a compromised wallet linked to its July 2025 security breach kept functioning and siphoned off user funds worth an estimated $16 million (yaani about 1.6 crore US dollars), The Hindu BusinessLine reported. The exchange told BusinessLine the wallet was connected to last year's $44 million breach (yaani about 4.4 crore US dollars).

Source: The Hindu BusinessLine

The activity was flagged on Thursday by an X user named DracyAri, who said about $15.99 million and 5,783.81 TRX had been taken after CoinDCX's hot wallet and multiple deposit addresses transferred funds to several other addresses. Cointelegraph reported that Darcy, co-founder of asset-recovery platform FlashRescue, had earlier flagged about $16 million in transfers from addresses labelled as belonging to CoinDCX.

Source: Cointelegraph

CoinDCX initially denied the claims, saying the flagged addresses were old wallets created in January 2025, compromised in July 2025 and not used since. It later confirmed the compromised wallet and said some users had continued depositing funds into the deprecated wallets despite warnings, while its process for sweeping those deposits into secure wallets failed for a period.

"This failure led to some operational losses, which were absorbed by CoinDCX," the exchange said in a statement reported by Cointelegraph. CoinDCX added that all affected deposits had been credited to users' accounts, its current wallets were unaffected, no funds from active wallets had been compromised, and customer assets remained in segregated cold wallets.

Key facts

Flagged transfers: about $16 million (yaani about 1.6 crore US dollars). Wallet: created January 2025, compromised in the July 2025 breach that cost about $44 million. CoinDCX says affected deposits were credited and losses were absorbed by the company.

Blockchain investigator ZachXBT challenged the exchange's account, alleging that a CoinDCX deposit address remained in use by a liquidity provider for months after the July 2025 hack and kept passing user deposits to the exchange's current hot wallet — an allegation CoinDCX has not accepted. The dispute has renewed calls from experts for stronger security oversight and audits in India's crypto sector, BusinessLine reported.

What is solid

  • CoinDCX confirmed a wallet compromised in its July 2025 breach kept functioning and that its deposit-sweeping process failed for a period.
  • About $16 million in transfers from CoinDCX-labelled addresses were flagged by third-party investigators on October 22.
  • CoinDCX says affected deposits were credited, losses were absorbed by the company, and current wallets and segregated cold wallets were unaffected.

What is only claimed

  • Investigator ZachXBT alleges a compromised deposit address stayed in active use for months after the 2025 hack — CoinDCX's initial statement said the old addresses had not been used since July 2025.