About $16 million in USDT and TRX left wallets linked to CoinDCX on Wednesday, according to an on-chain watcher posting as Darcy, and the exchange says it was not hacked, CoinDesk reports.
The largest single transfer was 15,819,002 USDT. Everything went to one Tron address, which then split the funds across several wallets, and Darcy called it suspected theft.
CoinDCX says the flagged addresses were created in January 2025, compromised in its July 2025 hack and unused since.
Chief executive Sumit Gupta called it a false alarm and said the earlier attackers appear to be reusing the old addresses. The exchange says its current central and user addresses were unaffected.
It also acknowledged a temporary failure in its process for sweeping deposits from retired addresses, which caused operational losses, and says it credited every affected user. It has not said how large those losses were.
The on-chain investigator ZachXBT disputes the account. He said one deposit address was used by a liquidity provider for about 10 months after the July 2025 incident, and alleged it swept user deposits and sent gas to CoinDCX’s current public hot wallet as recently as April and May 2026.
The July 2025 breach cost about $44 million. The $16 million figure and its link to CoinDCX come from outside observers, and neither has been independently verified.
Both accounts cannot be right about whether those addresses were retired. Until CoinDCX publishes its address list or an audit, the question stays open, though trading continues and the exchange says customer assets sit in cold wallets.
