CoinDCX Wallet Transfers Put Old Deposit Addresses Under Scrutiny
The CoinDCX wallet transfers controversy has moved beyond an argument about whether suspicious addresses were “old.” The central question is why funds remained exposed in previously compromised wallets—and how the exchange monitored deposits reaching them.
CoinDCX maintains that its active infrastructure was not newly breached. However, its subsequent acknowledgment of a failed deposit-sweeping process adds an operational explanation to the initial denial.
According to the exchange’s statement, some users continued sending crypto to deprecated addresses despite earlier warnings. CoinDCX said its process was intended to collect those deposits, but failed for a period, resulting in losses the platform has absorbed. It also said affected deposits had been credited to users’ accounts.
That distinction matters for customers. A platform can deny a new compromise of its current systems while still acknowledging financial exposure associated with older infrastructure.
What Researchers Reported
Security researcher Darcy flagged the transfers on October 22, identifying movements involving USDT and TRX on the TRON network.
The reported funds converged on an address before being split across additional wallets. The largest individual transfer was approximately 15.82 million USDT. Researchers subsequently traced portions toward deposit addresses associated with Binance, OKX and Gate.
Those destination labels require careful interpretation. Funds reaching an exchange-linked address do not establish that the receiving exchange participated in wrongdoing. They identify potential points where investigators could seek account information, transaction records or assistance.
Likewise, a blockchain transfer establishes that assets moved between addresses. Determining who authorized it, how credentials were obtained and who ultimately controlled the receiving accounts requires additional evidence.
How CoinDCX’s Explanation Developed
Stage | Public position or finding |
Initial alert | Researchers identified substantial outflows from CoinDCX-associated addresses. |
Initial response | CoinDCX denied a new breach and described the addresses as compromised during its July 2025 incident. |
Investigator challenge | ZachXBT highlighted subsequent activity linking a disputed address to the exchange’s operating wallets. |
Follow-up explanation | CoinDCX acknowledged failed deposit sweeping, operational losses and credits to affected users. |
The progression is important because the follow-up provides information missing from the initial response: deprecated addresses were still receiving deposits that required an operational process to handle them.
Why ZachXBT Challenged the “Old Wallet” Explanation
Blockchain investigator ZachXBT questioned whether an address could reasonably be described as unused when it continued interacting with the exchange’s infrastructure.
He pointed to a deposit address beginning TQKJQ, alleging that it continued forwarding user deposits and receiving transaction-fee funding after the July 2025 incident. CoinDCX co-founder Sumit Gupta subsequently said the matter was being investigated and assured users they would not bear losses.
Separately, blockchain analytics provider Bitquery published an investigation arguing that routine deposit-handling activity continued through affected addresses on October 21.
Its analysis identified 40 affected wallets and a narrow interval between a routine transaction and the first movement it attributed to the attacker. These remain Bitquery’s investigative findings; the firm also noted that the public transaction record could not establish how the relevant private keys were obtained.
That unresolved access question is central to determining whether this was exploitation of an earlier compromise, a separate security failure or another mechanism.
What Is Deposit Sweeping?
An exchange may assign customers individual receiving addresses while managing funds centrally.
A sweeping system detects incoming deposits and moves those assets into another wallet used for treasury or operational purposes. The customer’s exchange balance and the location of the underlying blockchain assets are therefore separate records that must remain reconciled.
If an address is retired, the technical ability to receive crypto does not necessarily disappear. Someone with a saved address can still send funds there.
This creates several responsibilities: communicating replacement addresses, monitoring incoming transactions, restricting access to compromised credentials and deciding how exceptional deposits will be handled.
Bitnxt’s guide to hot wallets versus cold wallets explains the custody distinction behind these systems. Offline storage can reduce some risks, but the processes connecting deposit addresses and operational wallets still matter.
What Customers Should—and Should Not—Infer
CoinDCX’s assurance that affected accounts have been credited is significant. It should nevertheless be attributed to the company rather than presented as an independently completed audit.
A credited account balance, the recovery of transferred assets and the remediation of a security weakness are three different outcomes.
Customers following the incident should look for clarity on:
The period during which sweeping failed.
How deposits were reconciled against customer balances.
Whether access to the affected addresses has been fully addressed.
The scope and findings of any independent review.
Before making a new deposit, users should retrieve the current address through the exchange’s official interface rather than relying on an old saved destination.
Moving to self-custody also introduces key-management responsibilities. Readers comparing options can consult Bitnxt’s wallet directory, while its wallet permission and scam-check guide explains why recovery phrases and signing requests need careful handling.
Bitnxt View: “Deprecated” Needs an Operational Meaning
For Bitnxt, the strongest lesson concerns what happens after a wallet is retired.
A label in an internal system cannot prevent a blockchain address from receiving funds. If users continue depositing, the platform needs a reliable process for detecting and addressing that activity—especially when the address was previously compromised.
The next meaningful update would explain the failure’s duration, financial impact and corrective measures. That would help readers evaluate the incident more effectively than a debate over the word “hack.”
The evidence supports scrutiny of a substantial outflow and an acknowledged operational failure. It does not justify unsupported claims about CoinDCX’s solvency, the identity of the actor or a compromise of every current customer wallet.
You might also like: Hot Wallet vs Cold Wallet: Which One Do You Actually Need?
