On July 19, 2025, Indian crypto exchange CoinDCX publicly disclosed a security incident involving unauthorized access to one of its operational wallets on the Solana blockchain. While no user funds were affected, approximately $44.2 million in USDC and USDT was siphoned from the wallet and laundered across chains. This article traces the post-exploit fund movements from Solana to Ethereum, outlines the laundering techniques used, and documents CoinDCX’s public recovery and bug bounty response.
On July 12, 2025, CoinDCX was the target of a sophisticated infrastructure-level exploit. The attackers penetrated the exchange’s server-side systems, gaining unauthorized access to an internal operational wallet used exclusively for liquidity provisioning on a partner exchange.
Unlike typical exploits that seek access to customer funds or private keys, this incident targeted backend infrastructure. The compromised wallet was internet-connected (ie. a hot wallet) and separate from CoinDCX’s customer wallets and cold storage. It was also excluded from the exchange’s published proof-of-reserves.
According to CoinDCX’s investigation, the attack involved:
CoinDCX disabled the compromised wallet upon discovery, launched an internal investigation, and disclosed the breach publicly on July 19. The company has since initiated a recovery and bug bounty program to address the breach and strengthen its infrastructure.
Merkle Science reviewed the post-exploit movement of funds to understand the CoinDCX attacker's laundering behavior across Solana and Ethereum. The transactions observed suggest a deliberate approach to fragmentation, routing, and eventual consolidation.
Initial Setup and Funding
The attacker received approximately 1 ETH via Tornado Cash shortly before initiating any outbound transactions. This early funding may have been used to cover operational costs such as gas fees and scripting, indicating some level of pre-exploit planning. It also served a critical operational security function by providing clean ETH without revealing the attacker’s original funding source.
The ETH was routed through FixedFloat, a privacy-centric instant exchange, likely swapped for assets compatible with Polygon. These were then bridged to Solana via deBridge, laying operational groundwork on Solana ahead of the exploit.
Outflows From the Compromised Wallet
As of this update, the entirety of the stolen assets—approximately $44 million—has been consolidated into a single Ethereum address. The address currently holds ~4,443 ETH and remains under monitoring for further movement.
Fig 1: Flow of Funds Analysis
This laundering flow, spanning Tornado Cash funding, SOL batch fragmentation, and cross-chain movement via Wormhole and Jupiter, required real-time, multi-chain tracing far beyond what static tools can capture.
Merkle Science’s Tracker Is Built for This Level of Sophistication:
In response to the exploit, CoinDCX launched what it described as India’s largest crypto recovery bounty, offering a total reward pool of $1 million. The program aims to encourage ethical disclosures, assist in fund recovery, and strengthen the exchange’s infrastructure security.
Key Details:
In parallel, CoinDCX is conducting a comprehensive audit of its infrastructure and reviewing access controls and wallet architecture. The exchange has stated that it will publish findings and improvements from this process to improve transparency and raise the bar for infrastructure-level security across the industry.
The CoinDCX exploit is part of a growing pattern of security incidents that reveal a clear evolution in how attackers are targeting centralized cryptocurrency exchanges. In the first half of 2025, more than half of the major crypto thefts reported globally have involved centralized platforms. These are no longer just attacks on smart contract code or protocol logic. Instead, they focus on the systems that manage internal liquidity, authorize transactions, and connect backend infrastructure to partner exchanges. Recent breaches at exchanges such as Bybit, Phemex, Nobitex, and BigONE illustrate this shift.
Further, while the motivations behind each incident may differ, ranging from financially driven theft to politically motivated disruption, the technical vector remains consistent. Attackers are no longer breaching surface-level systems—they are targeting the infrastructure that powers core exchange operations. This includes hot wallet orchestration, backend signing processes, liquidity automation tools, and internal API layers that interface with custodians or liquidity partners. These components, often designed for speed and uptime, have become high-value access points when not adequately segmented, monitored, or secured.
Hot wallet systems have emerged as particularly vulnerable. Incidents involving CoinDCX, BitoPro, and BigONE all exploited moments where internal controls were temporarily relaxed or misaligned with operational needs. These moments often occur during wallet upgrades, maintenance procedures, or automated liquidity provisioning, when internal monitoring may be deprioritized in favor of uptime or performance.
In parallel, attackers are demonstrating a higher degree of strategic planning in how they handle the assets themselves. After gaining access, they are not simply withdrawing funds and bridging them blindly. Instead, they are selecting asset types, swap routes, and bridging pathways with clear intent. Stablecoins such as USDC and USDT are often converted into assets like ETH or DAI, which lack centralized control mechanisms, in order to reduce the risk of issuer-initiated freezes or seizure. Assets are often prepared in advance for compatibility with specific bridges to ensure uninterrupted movement across chains.
Aggregators like Jupiter and 1inch are frequently used in laundering schemes because they enable deep liquidity access, reduce slippage on large swaps, and fragment transaction trails by splitting a single transaction across multiple DEXs and liquidity pools—complicating forensic tracing by creating dispersed, parallel transaction paths that are harder to correlate across chains.
These trends point to a deeper need for structural reform in how exchanges approach infrastructure security. As attacks continue to shift away from user interfaces and toward backend systems, exchanges must adopt a security posture that treats operational wallets, automated systems, and internal connectivity as first-class risk surfaces. Protecting these systems requires more than additional controls. It requires a complete reevaluation of how centralized platforms design, monitor, and govern the infrastructure that keeps their operations running.
At Merkle Science, we’re continuing to monitor fund movements, support attribution efforts, and collaborate with ecosystem partners on recovery. Our investigations are powered by Tracker, which enables real-time cross-chain tracing, watchlist alerts, and attribution transparency to accelerate response and support containment. Get in touch for a demo today.
