CoinDCX Says the $16 Million Isn't a New Hack. The Old One Is Still Moving Money.

CoinDCX says the $15.99 million that moved out of wallets tagged to its name isn't a new hack. It's the old one, still shedding debris. Co-founder Sumit Gupta's explanation is straightforward, those addresses belonged to the exchange before July 2025, they got hit in that breach, and whoever did it has been shuffling the proceeds around ever since. Plausible? Yes. Reassuring? Not entirely.

The Timeline, Told by Wallets

Start with July 2025. CoinDCX disclosed a breach that was reported at roughly $44 million, one of the larger incidents to hit an Indian exchange. The company acknowledged it, moved on, and for most of the following months the story went quiet.

Then a security researcher picked up about $15.99 million in Tether moving out of addresses tied to CoinDCX and flagged it publicly. On its face, that looked like a second hit. Same exchange, another eight figures gone.

Gupta pushed back. Those wallets, he said, were CoinDCX's before the July breach and were drained as part of it. The latest alert was a likely false alarm, an old crime scene getting a fresh visitor. He also took a swipe at how the flag was framed, which is fair enough. On-chain sleuthing is useful and noisy in equal measure, and a labeled address doesn't tell you when the label was minted.

The question worth asking: if the funds were already stolen in July, why does $16 million of it still sit in wallets anyone can tag to CoinDCX? Because attackers move slowly when the money's hot. That's the boring answer, and it's probably the right one.

What Actually Shifted

Nothing broke this week, if Gupta's account holds. But something did change in how people read CoinDCX.

The exchange's problem isn't the transfer. It's the labeling. Addresses stay tagged to a platform long after the platform loses control of them, and every subsequent movement reads as a fresh wound to anyone watching a dashboard. That's a communication failure as much as a security one, and it'll keep repeating until exchanges publish and maintain a clear list of compromised addresses with timestamps.

For users, the practical consequence is a nagging overhang. The July attacker still holds funds, and Tether can freeze USDT on request, which means some of that $15.99 million may never move again. That's good for recovery and bad for closure. And for a retail-heavy Indian exchange competing on trust in a market where trust is the whole product, an unresolved balance sheet ghost is a marketing problem dressed as a technical one.

I'm not entirely convinced the false-alarm framing will land with the skeptics. Proponents of CoinDCX's read have the on-chain timestamps on their side. The skeptics have the last four months of headline risk. History suggests the second group wins the narrative even when the first group wins the argument.

What to Watch

Three things, and they're checkable.

First, watch Tether's blacklist. If a chunk of that $15.99 million gets frozen in the coming weeks, Gupta's version gets a lot stronger, and the industry gets another argument for stablecoin issuers as de facto cops.

Second, watch the next proof-of-reserves refresh from CoinDCX. A clean attestation with a date attached does more than any thread.

Third, watch for another round of transfers from those same addresses. If money keeps leaving wallets CoinDCX says it no longer controls, at some point the label stops being a nuisance and starts being a liability.

Time will tell, though. For now the honest read is this. CoinDCX probably didn't get hacked twice. It just got caught owning a mess it hasn't finished cleaning up.