India's largest cryptocurrency exchange, CoinDCX, has denied that its active wallets were compromised after blockchain investigators flagged about $16 million in suspicious outflows from addresses linked to the exchange. The transactions involved old wallet addresses created in January 2025, which were compromised in July 2025 and have not been used by CoinDCX since. The exchange's spokesperson told CoinDesk that these addresses were not connected to CoinDCX and that current central and user addresses were not impacted. The outflows were attributed to a temporary failure in the exchange's process for moving deposits from retired addresses, which caused operational losses. CoinDCX absorbed these losses after crediting affected users. The exchange clarified that customer assets are stored in cold wallets and that no funds from active wallets have been compromised. Trading continues as usual.
The incident began when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses. The outflow totaled about $16 million, prompting further investigation. CoinDCX acknowledged that some users continued to deposit funds into deprecated deposit addresses instead of the latest ones, despite previous notifications. The exchange said sweeping is meant to catch such deposits but failed for a period. CoinDCX credited every affected user and emphasized that its current addresses were not hit. The exchange has not confirmed any breach of its active wallets and continues operations without interruption.
The incident highlights the challenges of managing legacy addresses in the cryptocurrency sector.
The incident also raises questions about the effectiveness of security measures and user awareness.