- CoinDCX CEO Sumit Gupta denies a fresh security breach after a $16M USDT transfer.
- Gupta links the flagged wallets to the July 2025 hack, which caused $44.2 million in losses.
- ZachXBT questions continued wallet activity and the accounting of the reported $15.8 million in USDT.
Indian crypto exchange CoinDCX has been facing fresh security concerns after reporting a $16 million USDT transfer. While the movement sparked questions about a possible hack, CEO Sumit Gupta denied it, arguing that the wallets were compromised in a July 2025 attack. He added that no new security incident has happened.
CoinDCX Denies Fresh Crypto Hack
In an X post earlier today, CoinDCX CEO Sumit Gupta has denied rumors about a fresh crypto hack involving the exchange. The speculation came after around $15.99 million in USDT was moved from wallets linked to the platform.
Concerns were raised when Salus chief marketing officer Darcy shared a post on X on October 22. He flagged the movement of funds. The post revealed that CoinDCX’s hot wallet and several deposit addresses sent funds to a single address on the TRON network on October 21. The funds moved included around 15.99 million USDT and 5,783.81 TRON (TRX). Later, the wallet moved smaller amounts to multiple addresses, linked to crypto exchanges like Binance, OKX, and Gate.
In response to these allegations, Sumit Gupta clarified that the incident does not point to a fresh hack. The wallets were compromised during the July 2025 attack. Thus, he believes that the hackers may be using old wallet addresses again to move funds.
Is the Latest Crypto Move Linked to an Earlier Attack?
While the CoinDCX CEO rejected claims of a fresh security breach, he added that the crypto movement is linked to an earlier hack in July 2025. According to him, the wallets were compromised previously, and the hackers are using them now to move the funds. Although Arkham Intelligence tagged the addresses as belonging to CoinDCX, Gupta clarified that attackers compromised them in the previous incident.
Gupta added that CoinDCX had checked the current central and user addresses. He asserted that no address had sent funds to the wallets flagged in the report. The CEO added that the company releases its wallet addresses on its proof-of-reserves (PoR). This allows users to check the addresses associated with the exchange.
For context, the CoinDCX hack took place in July 2025. Attackers reportedly stole around $44.2 million from an internal wallet. As noted by Gupta, the latest movement of funds is linked to the same wallet.
(adsbygoogle = window.adsbygoogle || []).push({});Fresh questions emerge
Following the movement of funds, crypto sleuth ZachXBT shared an X post, questioning CoinDCX’s handling of wallet addresses following the reported movement of nearly $16 million in USDT. The researcher stated that the address TQKJQ continued to be used by a liquidity provider (LP) for 10 months after the July 2025 security incident.
The report stated that the address swept up user deposits and received gas funds as recently as April and May 2026. The sleuth alleged that the address sent funds to CoinDCX’s current publicly listed hot wallet during the period.
Based on these reports, ZachXBT questioned why the exchange had continued to interact with an address reportedly compromised in the earlier attack. The sleuth also stated that the recent movement of $15.8 million in user deposits had not been properly accounted for by the exchange.
Related: Sumit Gupta Calls for Crypto Tax Reform in India
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
