CoinDCX Says $16M Outflows Came From Old Compromised Wallets
Analysts flagged about $16M in USDT leaving CoinDCX-linked addresses. The exchange blames old wallets; ZachXBT disputes it, and the CEO vows no user losses.

Indian exchange CoinDCX is disputing claims that about $16M left addresses tied to it. According to blockchain analyst Darcy, co-founder of FlashRescue, roughly 15.99M USDT and 5,783.81 TRX moved from a CoinDCX hot wallet and several deposit addresses to a single Tron address at 11:35 PM UTC+8 on Oct. 21 (10:35 AM ET). On Oct. 22 the exchange said it was not involved. Investigator ZachXBT disagreed.
Details
Darcy wrote that the largest single transfer was 15,819,002 USDT, after which the funds were split up and sent to deposit addresses at Binance, OKX and Gate.
At 4:14 AM ET, CoinDCX posted a statement saying user funds are safe. It said the addresses in question were created in January 2025, were compromised in July 2025 and have not been used by the exchange since, so the activity has no connection to CoinDCX. In July 2025 the exchange reported a $44M hack of an internal operational account.
At 4:52 AM ET ZachXBT pushed back. He said a deposit address beginning TQKJQ was used by a liquidity provider for 10 months after the July incident, swept user deposits to CoinDCX's current public hot wallet and received gas as recently as April and May 2026. In his estimate, $15.8M of user deposits went unaccounted for. That is the analyst's claim; the exchange has not confirmed it.
At 5:59 AM ET CEO Sumit Gupta replied that the team is aware, is investigating further and will share an update soon, adding that no user funds will be lost.
What this means for the market
It remains unclear whether this is a new exploit, activity on addresses compromised in 2025, or unaccounted deposits. The exchange has not finished its investigation and has published no detailed report. See Cointelegraph's coverage for more. For the market overview, see /en/; coins involved: USDT, TRX.



Comments