Blockchain investigators challenged CoinDCX's account of suspicious outflows totaling $16 million, with SpecterAnalyst accusing the exchange and co-founder Sumit Gupta of lying. On Thursday morning, Darcy, an investigator working for security firm Salus, identified suspicious transfers from addresses suspected of belonging to CoinDCX. Gupta thanked Darcy but rejected the attribution and urged Darcy not to spread rumors.
CoinDCX subsequently said the addresses had been created in January 2025 and compromised in July 2025. CoinDCX asserted that the exchange had stopped using the addresses after the compromise. CoinDCX suffered a $44 million hack last year after a software engineer's company laptop was compromised during work on side jobs.
CoinDCX contradicted the initial account in a second post by acknowledging that users continued depositing funds into a compromised address despite warnings. CoinDCX said the exchange regularly transferred those deposits out to account for and secure the funds. However, CoinDCX said that process failed during a particular period. The failure apparently became known only after Darcy publicized the withdrawal of funds. CoinDCX ultimately acknowledged operational losses and maintained that the deposits had been credited to user accounts. CoinDCX did not explain in detail how the $16 million remained unaccounted for over such a long period. CoinDCX had not answered an emailed request for comment by publication.
Darcy disputed CoinDCX's assertion that the exchange no longer used the wallets, citing gas distribution activity before and after the July 2025 hack. Darcy also said some funds reached addresses associated with Huione and Xinbi, known laundering guarantee services. Former MetaMask security specialist Taylor Monahan noted differences between the laundering methods used in today's transfers and last year's hack, suggesting different actors.
ZachXBT claimed that a liquidity provider used one affected address for 10 months after the compromise. ZachXBT also claimed that the address sent funds to CoinDCX's current public hot wallet as recently as May 2026. Tanuki42 highlighted contradictions in the exchange's communications. SomaXBT accused CoinDCX of transferring $70 million belonging to a market maker through the address that the exchange claimed was no longer in use.
SpecterAnalyst described the outflows as exhibiting signs typically associated with stolen funds. SpecterAnalyst said the affected address had previously transferred funds to CoinDCX's hot wallet. SpecterAnalyst said the address abruptly changed behavior by consolidating funds into one wallet that then distributed funds, exchanged assets and used over-the-counter services.
Blockchain Investigators Challenge CoinDCX's Account of $16M Suspected Outflows
ProtosShare
Summary
Blockchain news outlets report that investigators are questioning CoinDCX’s explanation of $16 million in suspicious outflows. SpecterAnalyst accused the exchange and Sumit Gupta of false claims, while Darcy identified ongoing transfers from addresses possibly linked to CoinDCX. The exchange said the addresses were hacked in July 2025 and no longer active, but others noted continued use and timeline issues. CoinDCX admitted to operational losses but did not explain how the $16 million went unaccounted for so long. A blockchain upgrade or improved transparency may be needed to resolve the dispute.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.