CoinDCX: 'Don't Spread Rumours,' Then $16M of 'Operational Losses'

At 21:05 on the evening of 21 October 2026, India time, 15,819,002 digital dollars left one address on the TRON payment network in a single transfer. The address had belonged to CoinDCX, one of India's largest crypto exchanges. By the time anyone raised the alarm the next morning, it had been split up and passed on.

With smaller sums from addresses that investigators link to CoinDCX, about 15.99 million USDT, worth about $16 million, went out that evening, plus 5,783.81 TRX. USDT is a digital dollar issued by the company Tether, a token meant to be worth exactly $1. TRON is a cheap payment network that carries much of the world's USDT, and TRX is its own coin. CoinDCX is a crypto exchange, which works like an online stockbroker for digital money. It had more than 20 million users by July 2025, and in October 2025 Coinbase, the largest US exchange, invested in it at a $2.45 billion valuation. CoinDCX itself had lost about $44 million to hackers in July 2025.

On 22 October Sumit Gupta, CoinDCX's co-founder and chief executive, answered the first public report on X: "Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours." Three hours and 37 minutes later the exchange posted that one of its processes had failed and that "this failure led to some operational losses, which were absorbed by CoinDCX."

Rumours, then losses

The first report came at 05:30 UTC from Darcy, chief marketing officer of the blockchain security firm Salus and co-founder of FlashRescue, a crypto recovery service. Darcy wrote, in Chinese, that CoinDCX was suspected of having had about 15.99 million USDT stolen from its hot wallet and several deposit addresses, and that it had been split and sent on towards the exchanges Binance, OKX and Gate.

Gupta replied at 08:10 UTC. The addresses "were generated in Jan 2025 and were compromised in the previous hack in July 2025," he wrote. "The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm." He said none of CoinDCX's current addresses, which it lists publicly as proof of reserves (a published list of the wallets an exchange says hold its customers' money), had sent money to them. Four minutes later the company's own account called the claims "misleading" and said the activity "does not have any connection with CoinDCX."

At 08:52 UTC ZachXBT, the pseudonymous investigator who had also raised the alarm over the July 2025 hack, replied that one of those addresses, beginning TQKJQ, "was in use by a LP for 10 months after your July 2025 incident" and had passed deposits on to CoinDCX's "current public hot wallet" as recently as April and May 2026. "Meaning $15.8M in user deposits was unaccounted for by your team," he wrote. At 09:59 UTC Gupta answered him: "Yes, aware of that. we're investigating it further, and will share an update soon. We assure that no user funds will be at loss."

What a dead wallet is

An exchange gives each customer or large client a deposit address of its own, like a personal account number for paying in. Its software then sweeps whatever lands there into a central hot wallet, the exchange's cash drawer, kept online so withdrawals can be paid at once. Most customer money sits offline in cold wallets, the vault. Every address is controlled by a private key, a secret code that is both the lock and the signature: whoever holds it can move the money. A blockchain address cannot be given a new lock. If its key may have leaked, the only safe course is to empty it and stop using it.

CoinDCX says that is what it did. In its statement at 11:47 UTC, TQKJQ and other addresses made in early 2025 "were compromised during the incident, and have since been deprecated", meaning retired. It said it had warned users not to deposit to them, but that "some users continued to deposit funds to deprecated deposit addresses." Its software was supposed to sweep those deposits to safety. "For a particular period, this sweeping process failed, which got identified today morning." It said every affected deposit had been credited to the user who made it, that customer assets "continue to be held in segregated cold wallets" and that its current addresses were untouched. It gave no figure for the loss.

What the blockchain shows

TRON's ledger is public, and Tronscan, its main explorer, shows TQKJQ's full history. The address was not emptied in July 2025. Between 19 July 2025, the day of the hack, and 4 May 2026 it received 449 deposits worth about $88.5 million from a single sending address. ZachXBT calls that sender an LP, a liquidity provider: a trading firm that keeps buy and sell orders on an exchange so trades fill instantly, like a market maker on a stock exchange. About $72.6 million of it was forwarded, usually within a minute, to the wallet ZachXBT identifies as CoinDCX's current hot wallet.

The forwarding stopped after 28 January 2026. From 29 January to 30 March, 88 deposits totalling exactly 15,819,002 USDT arrived and stayed. In late April and on 4 May forwarding started again: new deposits were swept within a minute, and the pile was left where it was. Each sweep needs a small fee paid in TRX, like postage, and those fees came 429 times between March 2025 and May 2026 from one address, beginning TFLxNH. Darcy says TFLxNH is a hot wallet in CoinDCX's latest proof of reserves. The ledger shows it also sent about 9,560 USDT to the address that collected the $15.8 million on 21 October. "Are you suggesting that the hackers were handling gas funding distribution for you?" Darcy asked.

The pile sat untouched for almost seven months. The address that collected it was activated about three hours before the big transfer and had passed every dollar on by 03:22 UTC the next morning, two hours before Darcy's first post.

SpecterAnalyst, another investigator, said the address's usual pattern had suddenly changed, its money swept into one wallet that swapped it and used private brokers, and concluded: "CoinDCX and its co-founder are lying." Taylor Monahan, a security researcher formerly at MetaMask, pointed out that "the July 2025 hack was not laundered in this manner." SomaXBT, who contributes to the security alliance SEAL, said CoinDCX had used the compromised wallet "to move the $70 million MM funds and left the $15.82 million" in it. Darcy traced about $8.9 million of it into Binance, OKX and Gate, and said some reached addresses linked to Huione and Xinbi. Huione Group is a Cambodian payments business the US Treasury cut off in 2025 as a money-laundering concern; Xinbi Guarantee is a Telegram market used by scam networks.

At 13:42 UTC ZachXBT wrote: "Withdraw all funds from CoinDCX if you value your assets." He called its co-founders "clowns running a circus" who "straight up lied or are negligently incompetent", and added that he had still helped freeze a six-figure sum for CoinDCX.

The $44 million hack it blames

The first hack came in the early hours of 19 July 2025, India time. Attackers emptied what Gupta called an internal account "used only for liquidity provisioning on a partner exchange", taking about $44 million in crypto on the Solana and Ethereum networks. ZachXBT flagged the theft publicly and said CoinDCX had waited 17 hours to disclose it. Gupta said no customer funds were affected and the company's treasury would absorb the loss; two days later he offered up to 25% of anything recovered, worth as much as about $11 million. The security firm Cyvers said the pattern resembled the work of North Korea's Lazarus Group; nobody has formally attributed the attack.

Police in Bengaluru later arrested a CoinDCX software engineer. Police said people offering paid freelance work had persuaded him to do it on his office laptop, and malware planted on that laptop gave the attackers access. He denied involvement in the theft, and a police officer said he had been unaware of the theft carried out through his laptop. No recovery of the July 2025 money has been reported.

Whether the keys to TQKJQ were taken in that attack, as CoinDCX says, has not been shown. On the public record, the address kept forwarding money to the wallet ZachXBT identifies as CoinDCX's hot wallet for more than nine months afterwards.