On-chain sleuths spotted roughly $16 million in USDT leaving wallets tied to CoinDCX, sparking fresh hack fears. Co-founder Sumit Gupta pushed back, saying these are the same addresses compromised in the exchange's July 2025 breach, not a new incident. Basically, old stolen funds still moving doesn't mean a new theft happened. Worth remembering before panic-selling on wallet-tracker alerts alone.
What Was Flagged And Why It Mattered
A security researcher tracking blockchain activity noticed roughly $15.99 million in Tether (USDT) moving out of wallets tagged to CoinDCX, an Indian crypto exchange. On-chain monitoring tools like this work by tagging wallet addresses known to belong to specific platforms, then alerting followers whenever large sums move from those addresses. When a tagged exchange wallet suddenly empties out, it often reads as a red flag for a possible hack, since large unexplained outflows have historically preceded breach disclosures at other platforms.
That pattern is exactly what triggered concern here: a sizable USDT movement from CoinDCX-linked addresses, with no immediate explanation, was enough to raise fresh hack fears among traders and observers watching the exchange closely.
CoinDCX's Response
CoinDCX co-founder Sumit Gupta denied that a new breach had occurred. According to Gupta, the flagged addresses were not freshly compromised. Instead, he said they were wallets that belonged to CoinDCX before its July 2025 hack, and were compromised during that earlier attack, as reported by BeInCrypto.
In other words, Gupta's explanation is that the funds visible on-chain were old stolen assets still being moved by whoever obtained them in the original 2025 breach, rather than evidence of a second, separate theft happening now.
Why Old Wallets Can Still Move Funds
This situation highlights something useful for anyone who follows on-chain alerts: once a wallet is compromised in a hack, the attacker typically retains control of it indefinitely unless the exchange can somehow revoke access, which usually isn't possible on public blockchains. That means stolen funds sitting in those wallets can be moved, split, or cycled through other addresses at any point after the original breach, sometimes long after the initial incident has already been reported and absorbed by the market.
So a large outflow from a wallet tagged to an exchange does not automatically mean a new hack just happened. It can simply be the continuation of activity tied to an older, already-known event. Distinguishing between the two requires context, which is why official confirmation or denial from the exchange matters before drawing conclusions.
What It Means For A Spot Trader
For spot traders, the main lesson here is about information discipline rather than any specific price move. Wallet-tracker alerts are useful early warning signals, but they are not confirmation of an event on their own. Treating every large flagged outflow as a fresh hack can lead to reactive decisions based on incomplete information, especially when an exchange's token or user funds are involved.
A more patient approach is to wait for clarification from the platform or credible follow-up reporting before adjusting positions, rather than reacting to a single on-chain alert. For those holding or trading assets connected to an exchange in situations like this, dollar-cost averaging into or out of positions over time, instead of making abrupt moves on unconfirmed news, remains a more measured way to handle uncertainty until the full picture is clear.