On Thursday morning, blockchain investigator “Darcy” flagged suspicious movements totalling $16 million on addresses suspected to be associated with crypto exchange CoinDCX.

Shortly afterwards, CoinDCX co-founder Sumit Gupta thanked the researcher, who works for security firm Salus, but insisted that the attribution was “incorrect,” urging Darcy “don’t spread rumours.”

A number of on-chain sleuths have since taken issue with CoinDCX’s statements, with “SpecterAnalyst” flatly accusing the firm and its co-founder of “lying.”

10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX 其中最大单笔为 15,819,002… — Darcy 资产救援 (@DarcyAri) October 22, 2026

Read more: CoinDCX hack: $44M gone after dev opens file from side gig

CoinDCX calls claims “misleading”

A later update from the exchange’s official X handle then stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.”

CoinDCX was hacked for $44 million last year after a software engineer’s company laptop was compromised while being used for work on side gigs.

Contradicting its initial statement, a second post clarified that CoinDCX users continued to deposit funds into the compromised address, despite the exchange warning against doing so. In response, it carried out “regular sweeping… so the funds can be properly accounted for and secured.”

Further update on the TQKJQ wallet On-Chain activity. Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been… — CoinDCX (@CoinDCX) October 22, 2026

Read more: Ledger spyware scare spreads beyond Southeast Asia

However, “for a particular period, this sweeping process failed,” and apparently only came to light after Darcy’s post, flagging the withdrawal of the funds.

CoinDCX eventually recognised the funds as “some operational losses,” and insists the deposits were credited to user accounts. It doesn’t go into detail on how the $16 million went unaccounted for over such a long period.

Protos has reached out to CoinDCX via email, but hadn’t received a response by the time of publication.

Read more: Bitget’s eighth birthday ends with a $352M hack

Blockchain sleuths have their doubts

Responding to Gupta’s initial denial, Darcy took issue with the claim that the wallets were not used by CoinDCX, pointing to gas distribution activities both before and after the July 2025 hack.

They also noted that some funds were sent to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” adding “please don’t dodge the issue.”

Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques differ between today’s transfers and last year’s hack, implying different actors.

Well known blockchain sleuth ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” post-compromise, and sent funds to “your current public hot wallet” as recently as May 2026.

Other pseudonymous investigators weighed in, with Tanuki42 highlighting the exchange’s contradictory communications and SomaXBT accusing CoinDCX of having moved $70 million of a market maker’s funds via the supposedly deprecated address.

For those who don't know how to identify stolen funds, it's often pretty easy. One way to identify a potentially compromised wallet is to look for a sudden change in its established transaction patterns. For instance, TQKJQ, a CoinDCX deposit address, had consistently been… pic.twitter.com/215kRk3jbT — Specter (@SpecterAnalyst) October 22, 2026

Read more: Phishing scammers capitalise on Ledger panic with fake firmware update

SpecterAnalyst’s aforementioned post describes the typical signals that indicate outflows of stolen funds.

It notes the change in behaviour from the affected address, which previously sent funds to CoinDCX’s hot wallet, to suddenly sweeping funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.