Indian cryptocurrency exchange CoinDCX has refuted allegations of a fresh $15.99 million security breach after security researchers flagged suspicious transfers of Tether (USDT) originating from wallets linked to the platform.
On-Chain Alerts Trigger Security Alarm
On October 22, Darcy, the chief marketing officer at security firm Salus, posted an alert on X detailing movements from CoinDCX's reported hot wallet and deposit addresses late on October 21 (UTC+8). The flagged transactions transferred approximately 15.99 million USDT and 5,783.81 TRON (TRX) to a single TRON address, with the largest single transfer accounting for 15.82 million USDT.
The recipient address subsequently split the funds across several secondary wallets before funneling them into deposit addresses on major centralized exchanges, including Binance, OKX, and Gate.
CoinDCX Clarifies Wallet Ownership and History
Responding less than three hours after the alert, CoinDCX co-founder Sumit Gupta dismissed the claims as a false alarm caused by outdated wallet tagging on Arkham. Gupta clarified that while the addresses were generated by CoinDCX in January 2025, they were compromised during a previous $44.2 million breach in July 2025 and no longer belong to the platform or its users.
According to Gupta, an internal audit confirmed that no active central or customer addresses transferred funds to the flagged wallets. He pointed out that all active platform wallets are publicly listed on CoinDCX's proof-of-reserves (PoR) page.
Key Takeaways:
- Alleged Outflow: 15.99 million USDT and 5,783.81 TRX moved to a central TRON address, including a primary transfer of 15.82 million USDT.
- Exchange Defense: Co-founder Sumit Gupta confirmed active exchange wallets are intact and verified via the platform's public proof-of-reserves page.
- Historical Link: The addresses involved were generated in January 2025 and compromised during CoinDCX's $44.2 million exploit in July 2025.
Why It Matters
False positive security alerts demonstrate how persistent legacy tags on analytics platforms like Arkham can spark market panic. When stolen or compromised addresses from historical breaches remain active under old entity labels, automated tracking tools can misinterpret hacker activity as active exchange vulnerabilities. For CoinDCX, clear public proof-of-reserves data and rapid executive communication remain essential tools to maintain user trust following previous security incidents.
