Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators

What it is

On-chain investigators and CoinDCX dispute whether about $16M in outflows from old CoinDCX-linked addresses was a new theft or a failed internal process. Protos reports that CoinDCX co-founder Sumit Gupta called Darcy's (Salus) attribution "incorrect" and told Darcy not to spread rumours. SpecterAnalyst accused the firm of "lying." Protos had no reply from CoinDCX by publication.

How it works

CoinDCX's account changed across its statements. The first said the addresses were created in January 2025, compromised in July 2025, and not used by the exchange since. A second post conceded that users kept depositing to the compromised address despite warnings. CoinDCX said it ran "regular sweeping" to account for those funds, but that sweeping failed for a period. The page says the failure apparently surfaced only after Darcy's post. CoinDCX then called the loss "some operational losses" and said deposits were credited to users. It did not explain how $16M went unaccounted for so long.

The investigators' counter-evidence:

• Darcy points to gas distribution before and after July 2025, which contradicts "not used."
• ZachXBT says one affected address was used "by a LP for 10 months" after the compromise and sent funds to CoinDCX's current public hot wallet as recently as May 2026.
• Darcy says some funds went to addresses linked to Huione and Xinbi.
• SomaXBT claims CoinDCX moved $70M of a market maker's funds through the supposedly deprecated address. The page gives no evidence for this.

What to do

The page offers one detection heuristic, from SpecterAnalyst. Flag an address that used to forward funds to an exchange hot wallet and then suddenly sweeps everything into a single wallet. If that wallet then distributes funds, swaps assets and uses OTC services, treat it as a stolen-fund outflow.

Caveats

Taylor Monahan, formerly of MetaMask security, notes the laundering techniques differ from the 2025 hack's. She implies different actors, so this may not be the same attacker. The page does not say who took the funds or whether CoinDCX's "sweeping failure" account is true. The attribution rests on investigators' public posts, not confirmed forensics. Tanuki42 also points to the exchange's contradictory communications.