Block sleuths question CoinDCX narrative on $16M suspicious fund movements

Accusations of deception over suspicious outflows

Blockchain investigators are accusing crypto exchange CoinDCX of providing misleading information regarding a recent transfer of $16 million in funds. The claims followed an initial post by researcher Darcy, who flagged suspicious movements on addresses associated with the exchange.

CoinDCX co-founder Sumit Gupta initially disputed the findings, urging the researcher not to spread rumors. However, CoinDCX later admitted that the exchange suffered "operational losses" of $16 million, explaining that a previous security incident had compromised specific wallet addresses.

The investigation highlights a discrepancy between the exchange's initial denial and its later acknowledgment of the funds moving to addresses linked to known money laundering services.

Key details of the investigation

• Darcy identified approximately 16 million USDT and 5,783 TRX moving to a specific TRON address.
• Several investigators, including SpecterAnalyst and ZachXBT, criticized CoinDCX's initial statements as "lying" or contradictory.
• Taylor Monahan noted that the laundering techniques in the recent transfers differ from those used in a previous $44 million hack, suggesting different attackers may be involved.
• CoinDCX stated that the affected addresses were compromised in July 2025 and had not been actively used by the exchange since that time.

What CoinDCX says about the compromised wallets

In a second statement, CoinDCX clarified that users continued to deposit funds into the compromised addresses despite warnings against doing so. The exchange claimed it performed regular sweeping operations to secure these funds. However, CoinDCX admitted that this sweeping process failed for a specific period, which apparently went unnoticed until Darcy's investigation flagged the withdrawals.

The exchange insists that the deposited funds were credited to user accounts and labeled the $16 million outflow as "some operational losses." CoinDCX has not provided detailed information on how these funds went unaccounted for over such a long period. As of publication, the exchange had not responded to further inquiries from Protos.

Uncertainties and differing claims

While CoinDCX frames the event as an operational loss resulting from a failed internal process, independent investigators suggest the funds may have been stolen. Darcy points to gas distribution activities on the compromised addresses both before and after the July 2025 hack, challenging the exchange's claim that the wallets were no longer in use. Additionally, SomaXBT accused CoinDCX of moving $70 million of a market maker's funds via the allegedly deprecated address.

The nature of the actors involved remains unclear. While CoinDCX implies an internal failure in their sweeping process, the divergence in laundering techniques noted by Taylor Monahan suggests that the recent movements might be the work of different individuals than those responsible for the earlier $44 million breach.

Why this matters for crypto users

This incident raises questions about how crypto exchanges manage security after a hack. A crypto exchange is a digital platform that allows users to trade digital assets. When users deposit funds into a compromised wallet, those assets are technically in a state of risk until they are moved to a secure "hot wallet," which is a digital wallet that holds cryptocurrency with a very small number of devices connected to the internet at any time to enhance security.

The contradiction between CoinDCX's initial denial and its later admission of operational losses could undermine user trust. It highlights the importance of transparency in security reporting, especially when previous breaches have affected the same infrastructure.

Recent context and next steps

Followers of CoinDCX may recall the $44 million hack that occurred last year, which was attributed to a software engineer's laptop being compromised while they worked on side projects. The exchange is currently navigating the fallout from that previous incident while addressing these new claims. There is no confirmed timeline for a full investigation into the $16 million discrepancy.

• Protos

Read also: Hyperliquid and CME split over where US compliance obligations should lie