On Thursday morning, blockchain investigator “Darcy” flagged suspicious movements totalling $16 million on addresses suspected to be associated with crypto exchange CoinDCX.
Shortly afterwards, CoinDCX co-founder Sumit Gupta thanked the researcher, who works for security firm Salus, but insisted that the attribution was “incorrect,” urging Darcy “don’t spread rumours.”
A number of on-chain sleuths have since taken issue with CoinDCX’s statements, with “SpecterAnalyst” flatly accusing the firm and its co-founder of “lying.”
10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX
CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX
其中最大单笔为 15,819,002…
A later update from the exchange’s official X handle then stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.”
CoinDCX was hacked for $44 million last year after a software engineer’s company laptop was compromised while being used for work on side gigs.
Contradicting its initial statement, a second post clarified that CoinDCX users continued to deposit funds into the compromised address, despite the exchange warning against doing so. In response, it carried out “regular sweeping… so the funds can be properly accounted for and secured.”
Further update on the TQKJQ wallet On-Chain activity.
Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been…
However, “for a particular period, this sweeping process failed,” and apparently only came to light after Darcy’s post, flagging the withdrawal of the funds.
Source link
