CoinDCX $16M Hack: What Blockchain Investigators Found
A public dispute between blockchain investigators and Indian crypto exchange CoinDCX has put a spotlight on a question that matters far beyond any single incident: when an exchange's on-chain activity contradicts its official statements, what does that mean for the firms, auditors, and CFOs who rely on that exchange's records? The CoinDCX case, still unfolding as of late October 2026, offers an unusually detailed view of the gap that can open between what an exchange says happened and what the blockchain actually shows.
How the Incident Came to Light
On the morning of 22 October 2026, a blockchain investigator using the handle "Darcy," employed by security firm Salus, flagged suspicious on-chain movements totalling $16 million across addresses believed to be linked to CoinDCX. The post was public, detailed, and almost immediately contested.
The initial denial and the pushback it triggered
CoinDCX co-founder Sumit Gupta responded quickly, dismissing Darcy's attribution as "incorrect" and telling the researcher not to "spread rumours." That denial did not hold for long. A number of other on-chain analysts entered the conversation, with the pseudonymous "SpecterAnalyst" going as far as accusing the firm and its co-founder of "lying."
Darcy reinforced their original findings by pointing to gas distribution activity on the flagged addresses both before and after a July 2025 compromise, directly contradicting the claim that the wallets were no longer in use. They also noted that some of the funds had moved to addresses associated with Huione and Xinbi, services widely identified in blockchain forensics circles as linked to laundering guarantee operations.
What the exchange eventually acknowledged
A statement from CoinDCX's official account on X offered a partial explanation: the addresses in question were created in January 2025, were compromised in July 2025, and had not been "used by CoinDCX" since. A subsequent clarification, however, contradicted that position. It acknowledged that users had continued to deposit funds into the compromised addresses, that the exchange had warned against this, and that it had been conducting "regular sweeping" to keep those funds properly accounted for and secured. The exchange admitted that "for a particular period, this sweeping process failed." CoinDCX ultimately described the sum involved as "some operational losses" and stated that user deposits had been credited to their accounts. It did not explain how $16 million went untracked across such an extended window.
What Other Investigators Added
Several well-known blockchain analysts weighed in with findings that complicate CoinDCX's timeline further.
ZachXBT and the active-address question
ZachXBT, a widely followed on-chain investigator, noted that one of the affected addresses had been used "by a LP for 10 months" after the July 2025 compromise, and that funds from it had been sent to CoinDCX's current public hot wallet as recently as May 2026. If accurate, that is not consistent with an address that was deprecated immediately after a hack.
Taylor Monahan's laundering technique observation
Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques visible in the October 2026 transfers differ from those seen in last year's breach. The implication is that different actors may be involved, which would make the incident more complex than a single, contained compromise.
SomaXBT and the market maker funds
The pseudonymous analyst SomaXBT alleged that CoinDCX moved approximately $70 million of a market maker's funds through the supposedly deprecated address. The analysis highlighted a distinct change in the address's behaviour: where it had previously sent funds directly to CoinDCX's hot wallet, it began distributing funds across multiple destinations, swapping assets, and using OTC services. That pattern shift is precisely the kind of signal that blockchain forensics tools are designed to detect, and that manual reconciliation processes are likely to miss.
Why the Prior Breach Matters Here
CoinDCX suffered a separate security incident in 2025, attributed to a software engineer whose company laptop was compromised while being used for personal side projects. That earlier breach is relevant context: it established that the exchange had already experienced an endpoint security failure serious enough to create ongoing exposure across wallet infrastructure.
The fact that a second, apparently distinct incident could occur affecting some of the same address infrastructure, and remain undetected internally until a public on-chain post surfaced it, raises questions about the adequacy of the exchange's internal monitoring and reconciliation controls. For any accounting professional assessing counterparty risk, that sequence of events is significant.
Accounting and Compliance Implications for Firms
This case is not just a cautionary tale about one exchange. It illustrates a structural vulnerability that applies wherever a business holds digital assets on a third-party platform and relies on that platform's own reporting as the primary source of truth for its books.
The reconciliation gap problem
CoinDCX's sweeping process apparently failed silently, for an unspecified period, on addresses holding material sums. The exchange only acknowledged the issue after external investigators made their findings public. For a business or fund that holds assets on an exchange, this means a balance could be impaired, frozen, or simply missing, without any notification from the custodian.
Robust digital asset accounting software addresses this by pulling balances and transaction data directly from the blockchain, rather than depending solely on exchange-generated statements. When the on-chain record diverges from the exchange's reported balance, an independent data feed will surface the discrepancy. An exchange statement alone will not. This is where having the right crypto accounting software in place, one that captures on-chain activity independently of exchange APIs, becomes a genuine control rather than a reporting convenience.
Counterparty due diligence
Accounting firms advising clients with exchange-held crypto assets, and CFOs managing treasury positions on trading platforms, should treat this incident as a prompt to revisit counterparty assessments. The relevant questions are: does the exchange publish proof-of-reserves data, and how frequently? Does it disclose security incidents promptly and completely? Are its internal sweeping and reconciliation processes documented and auditable? The gap between CoinDCX's initial denial and its subsequent partial admissions underlines why qualitative due diligence on an exchange's disclosure culture matters, not just its regulatory registration status.
Fund flow monitoring and AML obligations
For firms with AML reporting obligations, the alleged connections between the flagged addresses and services associated with laundering guarantee operations introduce a separate layer of risk. If a business has received funds that passed through those intermediary addresses, even unknowingly, it may have a suspicious activity reporting obligation depending on its jurisdiction. The appropriate response is to document the analysis, seek legal advice, and ensure your transaction monitoring systems flag any historical exposure. Protos has reached out to CoinDCX for comment; the exchange had not responded at the time of publication.
For context on how enforcement agencies are approaching exactly this type of blockchain-traced fund flow, see our coverage of how the White House cybercrime roundtable shapes crypto enforcement.
What Auditors Should Document Now
If you are auditing or reviewing an entity that held assets on CoinDCX during 2025 or 2026, several steps are warranted.
Balance verification and impairment assessment
Do not rely on exchange-provided statements alone for the period from July 2025 onward. Cross-reference reported balances against on-chain data for any addresses linked to the client's CoinDCX account. If balances cannot be independently verified, the assets may need to be treated as impaired pending further evidence. Under IFRS 9 and IAS 36 principles applied by analogy to digital assets (or directly, depending on the accounting policy adopted), an inability to confirm the existence and recoverability of an asset is a trigger for disclosure, if not impairment recognition.
Disclosure obligations
Where a client has material exposure to an exchange that is subject to an ongoing, publicly disputed security incident, auditors should consider whether that exposure requires disclosure as a contingent liability or a subsequent event, depending on the reporting date. The lack of a clear, verified account from CoinDCX means the uncertainty is real and quantifiable at a minimum of $16 million at the exchange level. Client-specific exposure will depend on the scale of holdings.
Our earlier analysis of crypto accounting software for enforcement red flags covers how enforcement actions and disputed disclosures should feed into audit risk assessments more broadly.
The Transparency Standard the Industry Needs
What makes the CoinDCX incident instructive is the sequence: a public on-chain researcher spots an anomaly, the exchange denies it, multiple independent investigators corroborate the anomaly with additional data, and the exchange then issues a partial acknowledgement that itself contains internal contradictions. At no point did the exchange proactively disclose the sweeping failure, the ongoing use of a compromised address, or the "operational losses" until external pressure made denial untenable.
This is not unique to CoinDCX. It reflects a wider pattern in which exchanges treat security incidents as reputational events to be managed rather than financial events to be disclosed. The professional accounting and compliance community, particularly firms using crypto bookkeeping software to maintain independent records of client holdings, is well positioned to identify these gaps before they become audit findings or regulatory referrals. The blockchain does not lie; the question is whether the reconciliation process is sophisticated enough to listen to it.
Frequently Asked Questions
What is the CoinDCX incident about?
Blockchain investigators flagged suspicious on-chain movements of approximately $16 million linked to CoinDCX addresses in October 2026. The exchange's initial denial was contradicted by subsequent statements and by independent on-chain analysis, which found the affected addresses continued to be used well after the July 2025 compromise the exchange cited.
How does this affect businesses that hold assets on crypto exchanges?
Any business relying solely on exchange-provided statements for balance verification is exposed to the risk that an exchange's internal records diverge from on-chain reality. Independent digital asset accounting software that pulls data directly from the blockchain provides a separate verification layer that exchange API feeds alone cannot offer.
Do auditors need to do anything specifically about CoinDCX?
Auditors reviewing entities with CoinDCX exposure for periods from July 2025 onward should verify balances independently using on-chain data, assess whether any impairment recognition is required, and consider whether disclosure of contingent risk is warranted given the publicly disputed and unresolved nature of the incident.
What are the AML implications if funds passed through the flagged addresses?
If investigators' findings regarding connections to addresses associated with laundering-linked services are accurate, any firm that received funds traceable to those addresses may have a suspicious activity reporting obligation. The appropriate steps are to document the analysis, consult legal counsel, and review historical transaction monitoring records.
Why does the prior 2025 breach matter for assessing this incident?
The 2025 breach, caused by a compromised employee laptop, established an existing weakness in CoinDCX's endpoint and wallet security. A second incident affecting overlapping address infrastructure, and apparently going undetected internally until external researchers flagged it, suggests that the remediation after the first breach may not have been complete. For counterparty risk assessments, repeated incidents of the same type at an exchange are a material factor.
Source: Protos