India's largest crypto exchange says flagged wallets were compromised in its July 2025 hack, but ZachXBT says at least one stayed in use for months afterward

CoinDCX is back under the microscope. Over October 21-22, 2026, on-chain analysts spotted approximately $15.99 million in USDT, plus 5,784 TRX, moving out of wallets tied to India’s largest crypto exchange.

Arkham Intelligence was first to raise the alarm. Its data showed funds leaving addresses labeled as CoinDCX deposit and hot wallets on the Tron network.

After leaving those addresses, the money was split up and scattered across several centralized exchanges, including Binance, OKX, and Gate .io.

Co-founder Sumit Gupta moved quickly to deny any breach or user impact. According to Gupta, the wallets were created in January 2025 and were then compromised during a July 2025 incident in which CoinDCX lost $44 million from an internal liquidity wallet.

Gupta said those addresses had not been used since that hack and that the exchange’s current operational addresses showed no linked outflows.

Gupta also told users their funds remain secure and that trading and other services were running without interruption.

Daily. Free. Join 34,000+ readers across crypto, finance, and policy.

Blockchain investigator ZachXBT was not convinced. He pointed to at least one flagged address that kept receiving user deposits and gas fees until April-May 2026.

That timeline matters. It would mean the address stayed active for roughly 10 months after the July 2025 incident that supposedly retired it.

If ZachXBT’s reading holds, users may have kept sending deposits to an address the exchange considered compromised, raising a pointed question about whether any of those deposits went unaccounted for.

The July 2025 hack cost the exchange $44 million, a loss it absorbed from an internal wallet rather than from customer balances.

The clearest way to settle the dispute would be a transparent accounting — explaining why a supposedly retired address kept receiving deposits and gas through April-May 2026, and confirming what happened to those deposits.

The involvement of Binance, OKX, and Gate.io as landing spots for the fragmented funds is another thread to watch. Centralized exchanges can freeze assets when they are flagged quickly enough, so how those platforms respond may shape whether any of the money is traceable or recoverable.