CoinDCX Reports Operational Losses After $16M Wallet Transfers Scrutiny

Indian cryptocurrency exchange CoinDCX has acknowledged operational losses tied to its handling of deposits sent to blockchain addresses that had been compromised in its July 2025 hack. The update follows public scrutiny of roughly $16 million in suspicious transfers that investigators said were associated with CoinDCX-labeled addresses.

In a statement published on X on Thursday, CoinDCX said some users continued depositing crypto into older addresses that were still linked to the incident. The company claimed it routinely moves such deposits out of compromised addresses into secure systems to account for the funds, but that this withdrawal process did not function as intended for an unspecified period.

Key takeaways

• CoinDCX says operational failure prevented timely movement of deposits from compromised addresses, resulting in losses the exchange absorbed.
• The exchange maintains its current wallets were unaffected and that customer assets remain in segregated cold storage.
• Investigator Darcy and others highlighted about $16 million in transfers from addresses labeled as belonging to CoinDCX, prompting challenges to CoinDCX’s earlier explanation.
• Blockchain investigator ZachXBT alleged a compromised deposit address continued to transact for months after the July 2025 incident.

Why CoinDCX’s latest admission matters

The new disclosure shifts the focus from the original hack itself to subsequent operational controls—specifically, how user deposits were processed when they arrived at addresses associated with the compromised infrastructure. For users, the distinction is important: CoinDCX’s claim is that customer assets remain intact and segregated, while the loss occurred because CoinDCX did not successfully migrate deposits away from the flagged addresses.

For traders and risk managers, the episode also highlights a persistent challenge after exchange security incidents: even if customer balances are intended to be isolated, operational procedures around deposit handling must remain reliable. Once addresses are marked compromised, any continued receipt of funds into those addresses can complicate tracking, recovery efforts, and reconciliation—even if the exchange ultimately covers any shortfall internally.

From warnings to deposits: CoinDCX explains the operational breakdown

According to CoinDCX’s X statement, some users continued depositing into addresses affected by the July 2025 hack despite warnings to stop. CoinDCX said it normally transfers deposits out of those older addresses to secure and account for the funds. This time, it admitted that the transfer process failed for an unspecified duration.

“This failure led to some operational losses, which were absorbed by CoinDCX,” the exchange wrote.

CoinDCX also reiterated that the affected deposits had been credited to users’ accounts. It further maintained that its current wallets were unaffected—stressing that no funds from active wallets were compromised and that customer assets remain held in segregated cold wallets.

At the time of the update, CoinDCX had not responded to Cointelegraph’s inquiry for additional context beyond its social media statements.

Investigators dispute the earlier timeline and address activity

The latest explanation follows CoinDCX’s earlier response to concerns raised by Darcy, a co-founder of asset recovery platform FlashRescue. Darcy had flagged about $16 million in transfers from addresses labeled as belonging to CoinDCX.

In an earlier statement on X posted, CoinDCX said the flagged addresses were created in January 2025, compromised in July of that year, and had not been used by the exchange since. Darcy’s concerns—and subsequent replies from other observers—suggested that, at least in terms of on-chain activity, the story was more complicated.

Blockchain investigator ZachXBT challenged CoinDCX’s account, claiming that a CoinDCX deposit address remained in use by a liquidity provider for roughly 10 months after the July 2025 incident. ZachXBT said the address continued transferring user deposits to CoinDCX’s current public hot wallet while also receiving funds to cover transaction fees.

CoinDCX CEO Sumit Gupta acknowledged the concern, saying CoinDCX was investigating further and would share an update soon in response. Gupta also stated that CoinDCX assured no user funds would be at loss.

How this relates to the July 2025 hack and what remains unclear

CoinDCX previously reported losses of $44 million in the July 2025 hack, and Cointelegraph coverage at the time noted that the exchange said customer wallets were separate from the affected account. CoinDCX also said it would cover the loss from treasury reserves.

The new operational loss admission does not contradict the idea that user assets were intended to be segregated, but it introduces a different failure mode: deposits arriving at compromised or legacy addresses, and CoinDCX’s inability (for an unspecified period) to move those deposits out as part of its recovery and accounting process.

What is still uncertain from the available statements is the duration of the breakdown and the precise mechanism that led to operational losses. CoinDCX did not specify how long the transfer process failed, how many deposits were involved, or how it ensured that credits to users were completed while losses were absorbed by the company rather than debiting customer holdings.

For observers, the key detail to watch next is whether CoinDCX will provide more precise operational timelines and technical clarifications—particularly around address usage after the July incident, and how liquidity providers and deposit flow were managed during the period investigators described.

Until those points are addressed, the case remains a useful reminder for the industry: post-incident security is not only about stopping attackers, but also about ensuring deposits, address labeling, and operational workflows remain consistent as investigations and recovery processes evolve.