Indian cryptocurrency exchange CoinDCX has acknowledged that a failure in its deposit sweeping process caused operational losses, after about 15.99 million Tether (USDT) was drained from TRON blockchain wallets linked to the exchange on October 21, 2026.
The admission came hours after the exchange and its co-founder publicly denied any new breach and described the affected addresses as old wallets compromised in its July 2025 hack, an account that on-chain investigators have since disputed with public blockchain records.
Show
How the $16 Million Left CoinDCX-Linked Wallets
USDT is a stablecoin pegged to the US dollar and issued by Tether. TRON is a blockchain widely used by exchanges to move USDT at low cost, and TRX is its native token.
On-chain analyst Darcy of blockchain security firm Salus was the first to publicly flag the outflows early on October 22. According to his post, about 15.99 million USDT and 5,783.81 TRX moved from CoinDCX-linked deposit addresses and hot wallets to a single newly created TRON address, TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT.
A hot wallet is an internet-connected wallet an exchange uses for daily transfers, while a cold wallet is kept offline for storage. Blockchain data provider Bitquery, which traced every wallet involved, found that the funds came from 40 TRON wallets. The largest single transfer, 15,819,002 USDT, left the deposit address TQKJ…qWUy at 15:35 Coordinated Universal Time (UTC), or 9:05 p.m. Indian Standard Time (IST). That one address accounted for about 99% of the total, or $15.82 million.
Bitquery’s timeline shows the exchange’s own system moved a routine deposit through one of the wallets at 12:14 UTC (5:44 p.m. IST). The attacker’s first transaction, a 100 TRX payment into the new address, followed at 12:19 UTC (5:49 p.m. IST), only five minutes later.
CoinDCX’s First Response: “Old Wallet Addresses”
CoinDCX co-founder and Chief Executive Officer (CEO) Sumit Gupta initially rejected reports of a fresh breach. In a post on X, he said the addresses “used to belong to CoinDCX before the last year hack i.e. July 2025,” had been “generated in Jan 2025,” and that “the hackers seem to be re-using the old wallet addresses.” He added that none of the exchange’s current central or user addresses had sent funds to the flagged wallets.
The exchange’s official account called the reports “misleading,” said the activity “does not have any connection with CoinDCX,” and stated that “Users’ funds are safe.” It pointed to its public Proof of Reserves (PoR) list, a disclosure exchanges use to show they hold enough assets to cover customer balances.
ZachXBT Disputes the Retired Wallet Explanation
Blockchain investigator ZachXBT challenged that account within hours. He said the TQKJQ deposit address, which he linked to a liquidity provider, kept receiving user deposits and transaction fee top-ups as recently as April and May 2026, roughly 10 months after the July 2025 incident. He also alleged that about $15.8 million in user deposits had gone unaccounted for.
Gupta replied that the team was aware and investigating, adding: “We assure that no user funds will be at loss.” ZachXBT later urged users to withdraw their funds from the exchange, citing inconsistencies in its disclosures.
What the On-Chain Record Shows
Bitquery’s wallet-by-wallet analysis found several contradictions with CoinDCX’s first statements.
To explain the findings, two terms matter. Sweeping is the automated process an exchange uses to move deposits from individual customer deposit addresses into its main hot wallet. Gas is the small network fee, paid in TRX on TRON, that each of those transfers requires.
The wallets were still in use. All 35 smaller deposit addresses drained by the attacker had a deposit swept out by the exchange after September 1, 2026. The hot wallet that paid gas fees, beginning TFLx, sent 276 top-ups of 15 TRX each since August 2026, with each one followed by a deposit sweep. The exchange’s system also swept a small deposit from a related address more than five hours after the theft.
The creation dates did not match. Of the 40 drained wallets, 26 were in use before 2025. None was first used in January 2025, the month CoinDCX cited.
Current wallets did interact with them. CoinDCX-labelled treasury wallets sent 14,519 TRX to the TFLx fee wallet between April and August 2026, contrary to Gupta’s statement that no current address had funded the flagged wallets.
One pile of deposits was never moved. At the TQKJQ address, 88 deposits from a single depositor that arrived between January 29 and March 30, 2026, were never swept. Together, they matched the $15.82 million taken. The last sweep from that address took place on May 4, 2026.
Bitquery noted that the blockchain record does not show how the attacker obtained the private keys or whether the drained deposits had been credited to customer accounts in the exchange’s internal books.
CoinDCX Admits Its Sweep Process “Failed”
Later on October 22, CoinDCX issued an official update. It said some users had kept depositing to deprecated addresses generated earlier in 2025 despite prior notices, and that its process for regularly sweeping those deposits “failed for a particular period.” The exchange said the problem was “identified today morning,” meaning October 22.
“This failure led to some operational losses, which were absorbed by CoinDCX,” the exchange said. It added that all affected user deposit wallets were credited, customer assets remain in segregated cold wallets, and no funds from active wallets were compromised. The update also noted that exchanges generally do not assume liability for deposits sent to deprecated addresses.
Tether Freezes $2.21 Million as Funds Reach Exchanges
Tether froze nine wallets holding 2,212,850 USDT at 22:45 UTC on October 22 (4:15 a.m. IST on October 23), according to Bitquery’s review of Tether’s freeze records. Crypto compliance firm AMLBot reported the freeze the following morning. A freeze, or blacklisting, prevents the frozen USDT from being transferred unless Tether lifts it.
The freeze came about 31 hours after the main transfer and covered roughly 14% of the stolen amount. By then, Bitquery’s data shows about $5.46 million had reached OKX, a net $2.61 million had reached Binance, and $1.39 million had reached Gate. Another $4.17 million went to wallets with unidentified owners, and about $110,000 left TRON through cross-chain bridges. Two attacker wallets holding 29,956 USDT had not been frozen as of 18:55 UTC on October 23.
Deposits into centralized exchanges (CEXs) are typically tied to accounts with identity verification records, which gives investigators a possible route to identify the person behind the theft.
Background: The July 2025 CoinDCX Hack
The incident follows a larger breach in July 2025. On July 19, 2025, Gupta disclosed that an internal operational account used only for liquidity provisioning on a partner exchange had been compromised. CoinDCX later confirmed that about $44.2 million was stolen and routed through Solana to Ethereum bridges. The exchange said it would absorb the loss from its own treasury reserves and was working with the Indian Computer Emergency Response Team (CERT-In). It also launched a recovery bounty offering up to 25% of any recovered funds.
Questions CoinDCX Has Yet to Answer
CoinDCX has not disclosed the exact size of the operational loss, how long the sweep failure lasted, how many users were affected, or how the attacker gained access to private keys for wallets while its own systems were still operating. Its explanation that users kept depositing to deprecated addresses also raises a further question: why those addresses continued to accept and process deposits for months if they had been retired.
The gap between the exchange’s first statements and the public blockchain record is the central concern for users. A denial issued before internal checks were complete, followed by a partial admission the same day, has drawn criticism over transparency at a platform that already absorbed a $44 million loss a year earlier. Reliable disclosure in such incidents requires a loss figure, a timeline, and an independent account of how keys were exposed.
For users, the exchange has advised verifying deposit addresses only through its official app or website. Those weighing their options can read about how CoinDCX withdrawals currently work.
Conclusion
CoinDCX maintains that customer funds are safe, active wallets were not breached, and affected deposits have been credited. The on-chain evidence, however, shows that wallets the exchange described as retired were in active use until the day of the theft, and that most of the $15.99 million moved beyond reach within a day, with only about $2.21 million frozen. Until the exchange publishes a full incident report, the key questions on security and wallet deprecation will remain open.
Also Read: WazirX Hack Victims Can’t Cash a Single Recovery Token; Nischal Shetty Says Trust Is Back