CoinDCX flags possible new breach worth roughly $16 million
Security & Exploits ·
On-chain sleuthing points to a fresh outflow of stablecoins and TRX from the Indian exchange, just months after a $44 million incident.
CoinDCX, among India's largest crypto trading platforms, is under scrutiny for what appears to be a fresh security incident, flagged by an on-chain investigator going by Darcy, according to a report. Blockchain records show that on October 21, around 15.99 million USDT and 5,784 TRX moved out of wallets and deposit addresses tied to the exchange, consolidating into one address on the TRON network. A single transaction within that movement accounted for 15.82 million of the USDT total, making it the dominant share of the suspected outflow.
After reaching the TRON address, the funds did not stay put. They were broken into smaller portions and funneled toward deposit addresses at three separate exchanges — Binance, OKX and Gate — a pattern consistent with efforts to obscure the trail and liquidate assets across multiple platforms before they could be flagged or frozen.
This is not CoinDCX's first brush with a large-scale loss this year. The exchange previously disclosed an approximately $44 million breach in July 2025, meaning the platform may now be facing its second major security event within a matter of months if the latest figures hold up.
As of the report, CoinDCX had not issued an official confirmation of the suspected October 21 theft, leaving the $16 million figure and the mechanics of the breach unverified by the company itself. The cluster shows the matter has drawn attention from at least two distinct sources tracking the same on-chain activity, lending some weight to the claims even without an exchange statement.
What remains unresolved is whether CoinDCX will confirm the incident, identify an attack vector, or detail what exposure customers may face. Also unclear is whether the funds routed through Binance, OKX and Gate have been frozen or recovered, or whether they have already been converted and moved beyond reach. Until the exchange responds, the scale and cause of the suspected hack remain based on on-chain inference rather than confirmed disclosure.