On Thursday morning, blockchain investigator “Darcy” flagged suspicious movements totalling $16 million on addresses suspected to be associated with crypto exchange CoinDCX.
Shortly afterwards, CoinDCX co-founder Sumit Gupta thanked the researcher, who works for security firm Salus, but insisted that the attribution was “incorrect,” urging Darcy “don’t spread rumours.”
A number of on-chain sleuths have since taken issue with CoinDCX’s statements, with “SpecterAnalyst” flatly accusing the firm and its co-founder of “lying.”
Read more: CoinDCX hack: $44M gone after dev opens file from side gig
CoinDCX calls claims “misleading”
A later update from the exchange’s official X handle then stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.”
CoinDCX was hacked for $44 million last year after a software engineer’s company laptop was compromised while being used for work on side gigs.
Contradicting its initial statement, a second post clarified that CoinDCX users continued to deposit funds into the compromised address, despite the exchange warning against doing so. In response, it carried out “regular sweeping… so the funds can be properly accounted for and secured.”
Read more: Ledger spyware scare spreads beyond Southeast Asia
However, “for a particular period, this sweeping process failed,” and apparently only came to light after Darcy’s post, flagging the withdrawal of the funds.
CoinDCX eventually recognised the funds as “some operational losses,” and insists the deposits were credited to user accounts. It doesn’t go into detail on how the $16 million went unaccounted for over such a long period.
Protos has reached out to CoinDCX via email, but hadn’t received a response by the time of publication.
Read more: Bitget’s eighth birthday ends with a $352M hack
Blockchain sleuths have their doubts
Responding to Gupta’s initial denial, Darcy took issue with the claim that the wallets were not used by CoinDCX, pointing to gas distribution activities both before and after the July 2025 hack.
They also noted that some funds were sent to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” adding “please don’t dodge the issue.”
Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques differ between today’s transfers and last year’s hack, implying different actors.
Well known blockchain sleuth ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” post-compromise, and sent funds to “your current public hot wallet” as recently as May 2026.
Other pseudonymous investigators weighed in, with Tanuki42 highlighting the exchange’s contradictory communications and SomaXBT accusing CoinDCX of having moved $70 million of a market maker’s funds via the supposedly deprecated address.
Read more: Phishing scammers capitalise on Ledger panic with fake firmware update
SpecterAnalyst’s aforementioned post describes the typical signals that indicate outflows of stolen funds.
It notes the change in behaviour from the affected address, which previously sent funds to CoinDCX’s hot wallet, to suddenly sweeping funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.