CoinDCX pledges no user losses after $16M transfers draw scrutiny
Source Entity
Cointelegraph by Zoltan Vardai
CoinDCX has denied a new security breach following reports of suspicious $16 million transfers linked to previously compromised wallets. While the exchange claims the wallets were abandoned in July 2025, investigators have challenged this, citing evidence of continued usage.
Security Scrutiny Surrounding CoinDCX
Indian cryptocurrency exchange CoinDCX is currently facing intense scrutiny following the identification of suspicious transfers totaling $16 million. These transactions, flagged by blockchain analysts, have raised significant concerns regarding the security protocols and operational integrity of the platform. While the exchange has issued a formal denial regarding a new breach, the discrepancy between their internal narrative and external investigative findings has sparked a broader debate about transparency in digital asset management.
The July 2025 Incident and Wallet Usage
At the heart of the controversy is the status of wallets created in January 2025, which CoinDCX asserts were compromised during a security incident in July 2025. The exchange maintains that these specific addresses were decommissioned immediately following the breach to prevent further exploitation. However, the official narrative has been directly challenged by prominent blockchain investigator ZachXBT, who provided evidence suggesting that these addresses remained active well beyond the date of the alleged abandonment.
Investigative Findings and Contradictions
ZachXBT’s analysis indicates that a deposit address associated with the July incident continued to be utilized by a liquidity provider for ten months. According to the investigator, this address was not merely dormant but was actively facilitating the movement of user deposits to CoinDCX’s current public hot wallet and receiving funds to cover ongoing transaction fees. This direct contradiction suggests either a failure in operational security protocols or a lapse in the exchange's internal auditing processes regarding legacy infrastructure.
Implications for User Trust and Asset Security
CoinDCX has moved to reassure its user base by pledging that there will be no losses incurred by customers due to these transfers. In the volatile ecosystem of cryptocurrency, such guarantees are vital for maintaining market confidence. However, the gap between the exchange’s public statements and the evidence presented by independent investigators highlights a critical need for more robust, transparent reporting mechanisms within the Indian crypto sector to ensure that users are not exposed to systemic risks.
Moving Toward Resolution
In response to the mounting pressure and the specific evidence presented by researchers, CoinDCX has acknowledged the need for further inquiry. By stating they are "investigating it further" and promising an update, the company is attempting to manage the narrative and mitigate reputational damage. The industry will be watching closely to see if the exchange can reconcile its previous statements with the forensic data provided by the blockchain community.
Future Trends in Exchange Security
This incident serves as a cautionary tale regarding the lifecycle management of digital wallet infrastructure. As exchanges scale their operations, the ability to effectively sunset compromised or legacy wallets is paramount. Moving forward, it is likely that regulatory bodies will demand more rigorous proof of wallet migration and security decommissioning as a prerequisite for operating within the digital asset space, ensuring that incidents like the July 2025 breach do not leave behind persistent vulnerabilities.