Treat

Channels

TRON

when

<h2 id="span-style-font-size-16px-color-inherit-font-weight-bolder-coindcx-hack-claim-update-wh-span-span-style-font-size-16px-color-inherit-font-weight-bolder-span-span-style-font-size-16px-color-inherit-font-weight-bolder-span-span-style-font-size-16px-color-inherit-font-weight-bolder-ere-did-the-16m-in-usdt-go-span">CoinDCX Hack Claim Update: Where Did the $16M in USDT Go?</h2>
The CoinDCX Hack question returned on October 21, when on-chain investigator Darcy flagged about $16 million in USDT leaving addresses linked to the Indian exchange. The money landed in a single TRON wallet before moving toward Binance, OKX and Gate.&nbsp;
CoinDCX says this is not a new breach, and no fresh theft has been officially confirmed. So, what’s the situation right now?
<h3 id="span-span-style-font-size-16px-coindcx-hack-claim-what-on-chain-data-shows-about-the-16m-trail-span-span">CoinDCX Hack Claim: What On-Chain Data Shows About the $16M Trail</h3>
<img alt="CoinDCX Hack Claim" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/KDplGuICkrLXTuzDGyGu2ZaTw121J3fddDolRxz2.png" width="300" height="312" title="CoinDCX Hack Claim">
Darcy, who is chief marketing officer at security firm Salus, traced the transfers to wallets labeled as CoinDCX hot wallets and deposit addresses, per his <a href="https://x.com/DarcyAri/status/2113140857717301483?s=20" style="font-size: 16px; background-color: rgb(255, 255, 255)" rel="noopener noreferrer nofollow">official X post</a>. The key details:
<ul>
 <li>Date: October 21, 2026</li>
 <li>Amount: about 15.99 million USDT and 5,784 TRX</li>
 <li>Largest single transfer: 15.82 million USDT</li>
 <li>First stop: one TRON address</li>
 <li>Next stop: funds split and sent to deposit addresses at Binance, OKX and Gate</li>
</ul>
Splitting funds and sending them to exchange deposits is a standard laundering step. It also gives those exchanges a chance to <a href="https://www.coingabbar.com/en/crypto-currency-news/tether-freezes-usdt-xinbi-guarantee-tron-wallets-frozen" rel="noopener noreferrer nofollow">freeze assets</a>. Whether any of the three has done so is not yet known.
<h3 id="span-span-style-font-size-16px-coindcx-says-old-2025-wallets-moved-the-funds-not-a-fresh-breach-span-span">CoinDCX Says Old 2025 Wallets Moved the Funds, Not a Fresh Breach</h3>
Co-founder Sumit Gupta rejected the fresh-breach reading in&nbsp;<a href="https://x.com/smtgpt/status/2113181173480607981" rel="noopener noreferrer nofollow">a post on X</a>. The company says the addresses were created in January 2025, were compromised in the July 2025 attack and have not been used since. It adds that current central and user wallets sent nothing to them.&nbsp;
<img alt="Co-founder Sumit Gupta rejected Hack Claims" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/fOon7PDfRxbnPUJJTz8CIZGqDDByPBOwysjHqAx9.png" width="300" height="367" title="Co-founder Sumit Gupta rejected Hack Claims">
In a&nbsp;<a href="https://x.com/CoinDCX/status/2113182200648864243" style="font-size: 16px; background-color: rgb(255, 255, 255)" rel="noopener noreferrer nofollow">separate post</a>, CoinDCX said user funds are safe and trading continues as normal.
<img alt="CoinDCX said user funds are safe" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/cLNlqYSdDbddeUCVkTWtqHbmSXSzR1eOaCS5Hn0g.png" width="300" height="373" title="CoinDCX said user funds are safe">
That framing suggests attackers may be moving leftover loot from the earlier case, not draining new funds. It rests on company statements, and independent confirmation has not appeared.
<h3 id="span-span-style-font-size-16px-looking-back-how-the-july-2025-coindcx-hack-cost-nearly-44-million-span-span">Looking Back: How the July 2025 CoinDCX Hack Cost Nearly $44 Million</h3>
The earlier CoinDCX Hack remains the context that makes this week’s alert credible. Per an&nbsp;<a href="https://www.coingabbar.com/en/crypto-currency-news/crypto-exchange-coindcx-hack-44m-stolen-in-major-breach" rel="noopener noreferrer nofollow">earlier coverage</a>:
<ul>
 <li>Loss: about $44 million</li>
 <li>Source: an internal liquidity account, not customer cold wallets</li>
 <li>Response: the company covered the loss from its treasury, isolated systems and paused some Web3 services</li>
</ul>
<h3 id="span-span-style-font-size-16px-what-users-should-know-now-proof-of-reserves-and-official-channels-span-span">What Users Should Know Now: Proof of Reserves and Official Channels</h3>
Customers can take a few practical steps while the picture settles:
<ul>
 <li>Follow only official channels: @CoinDCX, @CoinDCX_Cares and @smtgpt</li>
 <li>Check wallet addresses through the company’s Proof of Reserves page</li>
 <li>Treat unsolicited messages about refunds or recovery as scams</li>
 <li>Protect exchange accounts with two-factor authentication</li>
</ul>
Several questions remain open. Will independent analysts confirm the old-wallet link? Will Binance, OKX or Gate freeze anything? Will CoinDCX publish a fuller incident note?
The CoinDCX Hack story now turns on verification, not volume. If independent tracing ties the October 21 transfers to the 2025 compromise, the episode shows that old wallets stay dangerous long after an incident.&nbsp;
If it does not, the exchange will face pressure to open its books. Either way, the next Proof of Reserves update and any freeze by the receiving exchanges will say more than the first headlines did.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Crypto markets carry significant risk. Always do your own research before making any investment decisions.

CoinDCX Hack Claim: $16M Moved, Exchange Says No Breach

Table of Contents

Coingabbar

Other articles published on Oct 22, 2026

Join our free newsletter for daily crypto updates!