CoinDCX tied the transfers to wallets compromised in July 2025, but investigators said the addresses remained linked to its operations.