Blockchain investigators challenged CoinDCX's account of suspicious outflows totaling $16 million, with SpecterAnalyst accusing the exchange and co-founder Sumit Gupta of lying. On Thursday morning, Darcy, an investigator working for security firm Salus, identified suspicious transfers from addresses suspected of belonging to CoinDCX. Gupta thanked Darcy but rejected the attribution and urged Darcy not to spread rumors.
CoinDCX subsequently said the addresses had been created in January 2025 and compromised in July 2025. CoinDCX asserted that the exchange had stopped using the addresses after the compromise. CoinDCX suffered a $44 million hack last year after a software engineer's company laptop was compromised during work on side jobs.
CoinDCX contradicted the initial account in a second post by acknowledging that users continued depositing funds into a compromised address despite warnings. CoinDCX said the exchange regularly transferred those deposits out to account for and secure the funds. However, CoinDCX said that process failed during a particular period. The failure apparently became known only after Darcy publicized the withdrawal of funds. CoinDCX ultimately acknowledged operational losses and maintained that the deposits had been credited to user accounts. CoinDCX did not explain in detail how the $16 million remained unaccounted for over such a long period. CoinDCX had not answered an emailed request for comment by publication.
Darcy disputed CoinDCX's assertion that the exchange no longer used the wallets, citing gas distribution activity before and after the July 2025 hack. Darcy also said some funds reached addresses associated with Huione and Xinbi, known laundering guarantee services. Former MetaMask security specialist Taylor Monahan noted differences between the laundering methods used in today's transfers and last year's hack, suggesting different actors.
ZachXBT claimed that a liquidity provider used one affected address for 10 months after the compromise. ZachXBT also claimed that the address sent funds to CoinDCX's current public hot wallet as recently as May 2026. Tanuki42 highlighted contradictions in the exchange's communications. SomaXBT accused CoinDCX of transferring $70 million belonging to a market maker through the address that the exchange claimed was no longer in use.
SpecterAnalyst described the outflows as exhibiting signs typically associated with stolen funds. SpecterAnalyst said the affected address had previously transferred funds to CoinDCX's hot wallet. SpecterAnalyst said the address abruptly changed behavior by consolidating funds into one wallet that then distributed funds, exchanged assets and used over-the-counter services.