ZachXBT

Arkham

On-chain data showed suspicious transactions from a wallet linked to the CoinCDX exchange. Over $15M in stablecoins were moved from the wallet, which was exposed in an earlier breach in 2025.&nbsp;
The Indian crypto exchange <a href="https://www.cryptopolitan.com/indian-student-remanded-457000-crypto-fraud/" rel="noopener noreferrer nofollow">CoinCDX</a> is in the midst of a theft investigation. On-chain data linked a sudden outflow of funds from a wallet previously known to belong to the exchange.&nbsp;
The exchange denies that the wallet is currently under its control, claiming it was falsely flagged on Arkham Intelligence.&nbsp;
<blockquote>
 ‘The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm,’ explained on X the exchange’s <a href="https://x.com/smtgpt/status/2113181173480607981" rel="noopener noreferrer nofollow">co-founder</a> Sumit Gupta.
</blockquote>
The wallet transfers were noted late on October 21, moving $15.99M in USDT and 5,783.81 TRX. The funds were sent to an <a href="https://arkm.com/explorer/address/TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT" rel="noopener noreferrer nofollow">intermediary address</a>, which was then emptied out, with some of the USDT reaching Binance hot wallets, as well as OKX and Gate.&nbsp;
<h3 id="span-style-font-weight-400-coincdx-wallet-was-still-used-in-defi-protocols-span">CoinCDX wallet was still used in DeFi protocols</h3>
While CoinCDX denied using the wallet or controlling it, the address was still found to be active long after the 2025 exploit.&nbsp;
On-chain researcher ZachXBT noted the wallet has still been used as a <a href="https://x.com/zachxbt/status/2113191832561778974" rel="noopener noreferrer nofollow">liquidity provider</a>, while also sweeping user deposits. Additionally, ZachXBT noted CoinCDX still has to account for around $15.8M in user funds not accounted for in a transparent proof of reserves.&nbsp;
As Cryptopolitan previously <a href="https://www.cryptopolitan.com/ed-flags-coindcx-accounts-%E2%82%B9285-crypto-fraud/" rel="noopener noreferrer nofollow">reported</a>, CoinCDX has been flagged as an exchange used in fraud laundering. In 2025, the exchange also suffered a hack taking up to $44M.&nbsp;
The recent movement of funds may not represent another wallet theft, but actually show CoinCDX users still deposited to the wallet for at least 10 months after the 2025 hack. ZachXBT also discovered the current hot wallets still sent gas to the compromised address as late as April 2026.
CoinCDX is a relatively small exchange, with <a href="https://www.coingecko.com/en/exchanges/coindcx" rel="noopener noreferrer nofollow">$1.15M</a> in daily volume for the past 24 hours. The exchange’s most active pair is between fiat and USDT, with a limited number of assets offered. The exchange is seen as inherently risky, but now there are more doubts that the market operator may have failed to protect user funds, allowing deposits to refill an already compromised wallet.&nbsp;
<h3 id="span-style-font-weight-400-can-the-coincdx-funds-be-salvaged-span">Can the CoinCDX funds be salvaged?</h3>
In an unusual move, the funds from CoinCDX were moved to centralized exchanges. Most of the funds were also in USDT, meaning either Tether or the exchanges can freeze and revert the loss, but that depends on CoinCDX confirming the exploit.&nbsp;
The fund movements from the exploiter wallet also repeated the previous CoinCDX hack, where the funds were laundered through centralized markets.&nbsp;
Currently, CoinCDX is suspected of flawed security practices and of actually reusing its <a href="https://x.com/tayvano_/status/2113200977734246878" rel="noopener noreferrer nofollow">compromised wallets</a>, while not giving sufficient proof of the safety of user funds. CoinCDX once again issued a <a href="https://x.com/CoinDCX/status/2113182200648864243" rel="noopener noreferrer nofollow">statement</a> that it did not interact with those wallets, going against the on-chain evidence.&nbsp;
The CoinCDX exposure is a relatively rare event, as most of the hacks are targeting decentralized protocols. The suspected exploit against CoinCDX arrives at a time when crypto users are becoming more wary of hacks and accidental exposure, including the compromised private keys through <a href="https://www.cryptopolitan.com/railway-halts-deployments-api-keys-theft/" rel="noopener noreferrer nofollow">Railway</a> and the potential effects of the newly discovered <a href="https://www.cryptopolitan.com/php-fix-14-year-old-bug-day-early-leak/" rel="noopener noreferrer nofollow">PHP vulnerabilities</a>.&nbsp;
The CoinCDX exploit is still not fully understood, but if the exchange diverted user funds to a compromised address, it would further undermine trust in depositing crypto to exchange wallets. 
On-chain research found <a href="https://x.com/DarcyAri/status/2113206998028480778" rel="noopener noreferrer nofollow">additional links</a> between the hacker’s wallets and addresses used by CoinCDX, as noted by @DarcyAri, the account that first noticed the suspicious transfers.&nbsp;
Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

CoinCDX denies hack as researchers trace outflows to former hot wallets

Table of Contents

Cryptopolitan_News

Other articles published on Oct 22, 2026

Join our free newsletter for daily crypto updates!