WazirX

Million

TRON

ZachXBT

when

Indian cryptocurrency exchange CoinDCX has acknowledged failures in its deposit-processing system after nearly $16 million in USDT was transferred from wallets linked to the platform, reversing an earlier explanation that the suspicious activity involved only abandoned addresses.
The October 22 admission followed accusations from blockchain investigator <a href="https://cryptoadventure.com/zachxbt-the-on-chain-sleuth-shaping-crypto-accountability/" rel="noopener noreferrer nofollow">ZachXBT</a>, who challenged CoinDCX’s claim that the wallets had been inactive since a $44 million security breach in July 2025. The exchange now acknowledges that deposits continued reaching those addresses and that its process for collecting the funds had failed for a period.
CoinDCX maintains that affected customers were credited, operational losses have been absorbed by the company and assets held in its active custody infrastructure remain secure.
<h2 id="nearly-16-million-in-usdt-moved-through-tron-wallets">Nearly $16 Million in USDT Moved Through TRON Wallets</h2>
The suspicious transfers began on October 21, when approximately 15.99 million USDT and 5,784 TRX moved from addresses associated with CoinDCX into a newly created TRON wallet.
Blockchain security researcher Darcy first <a href="https://x.com/DarcyAri/status/2113140857717301483" rel="noopener noreferrer nofollow">flagged the transactions</a>, identifying transfers from multiple deposit addresses and wallets previously attributed to the exchange.
The largest transaction involved 15.82 million USDT leaving a single deposit address. The receiving wallet subsequently distributed the funds across several addresses, with substantial amounts eventually reaching accounts associated with Binance, OKX and Gate.
A detailed <a href="https://bitquery.io/investigations/coindcx-hack" rel="noopener noreferrer nofollow">transaction reconstruction</a> by blockchain analytics firm Bitquery identified approximately 40 affected wallets, including addresses that continued processing deposits after the July 2025 incident.
By October 22, roughly $9.63 million had reached identified exchange deposit addresses, while another $2.28 million remained in seven downstream wallets at the time of Bitquery’s analysis.
<h2 id="zachxbt-challenges-coindcx-s-initial-denial">ZachXBT Challenges CoinDCX’s Initial Denial</h2>
CoinDCX initially <a href="https://x.com/CoinDCX/status/2113182200648864243" rel="noopener noreferrer nofollow">rejected the allegations</a>, explaining that the flagged addresses had been created in January 2025, compromised during its previous security incident and discontinued.
Co-founder and CEO Sumit Gupta separately maintained that no active company or customer wallets had transferred funds to the affected addresses.
ZachXBT <a href="https://x.com/zachxbt/status/2113191832561778974" rel="noopener noreferrer nofollow">challenged that account</a>, identifying a deposit address beginning TQKJQ that remained connected to the exchange’s operational infrastructure for months after the previous breach.
The address continued receiving TRX for transaction fees and transferring deposits to CoinDCX-linked hot wallets as recently as April and May 2026.
Bitquery identified 88 deposits totaling approximately $15.82 million that had accumulated in the address between January and March before being transferred out during the October incident.
The exchange’s revised explanation acknowledged that users had continued depositing cryptocurrency into deprecated addresses despite instructions to stop using them.
CoinDCX had maintained an automated process to collect those deposits, but <a href="https://x.com/CoinDCX/status/2113235810988531883" rel="noopener noreferrer nofollow">acknowledged that sweeping had failed</a> for a period, resulting in operational losses.
ZachXBT subsequently <a href="https://x.com/zachxbt/status/2113264816546873716" rel="noopener noreferrer nofollow">accused the exchange of lacking transparency</a>, criticizing its initial rejection of the transaction evidence before acknowledging the processing failures.
<h2 id="coindcx-says-customers-were-credited-and-funds-remain-safe">CoinDCX Says Customers Were Credited and Funds Remain Safe</h2>
CoinDCX’s revised position is that all customer deposits sent to deprecated addresses were credited to user accounts, even when the corresponding assets had not been successfully collected.
The company maintains that its current operational wallets were not compromised and customer assets remain protected in segregated cold storage. Trading and other exchange services continue operating normally.
The exchange previously absorbed approximately $44 million in losses following its <a href="https://coindcx.com/blog/announcements/incident-report-july-19-2025" rel="noopener noreferrer nofollow">July 2025 security breach</a>, when attackers compromised an internal operational account used for liquidity provisioning.
CoinDCX had also faced earlier <a href="https://cryptoadventure.com/indian-crypto-exchange-coindcx-denies-moving-user-funds-after-wazirx-allegations/" rel="noopener noreferrer nofollow">questions about its custody arrangements</a>, rejecting allegations involving the movement of Indian customer assets to an overseas entity.
The latest dispute comes amid continued scrutiny of centralized cryptocurrency exchanges in India, where the <a href="https://cryptoadventure.com/wazirx-restructuring-cleared-in-massive-relief-for-230m-hack-victims/" rel="noopener noreferrer nofollow">WazirX restructuring</a> followed a separate $230 million security breach that left customers waiting for repayments.
ZachXBT has also previously <a href="https://cryptoadventure.com/zachxbt-accuses-kucoin-of-ignoring-hack-victims-and-police/" rel="noopener noreferrer nofollow">criticized KuCoin</a> over its handling of stolen cryptocurrency reports, including allegations that exchange deposit accounts were not frozen quickly enough.
CoinDCX has not publicly provided a complete reconciliation of the affected deposit balances, the final value of its operational losses or the status of any recovery efforts involving the transferred USDT. Its customer-credit assurances have not been independently reconciled against the exchange’s internal accounting records.
The post <a href="https://cryptoadventure.com/coindcx-admits-sweeping-failure-after-16-million-crypto-theft-allegations/" rel="noopener noreferrer nofollow">CoinDCX Admits Sweeping Failure After $16 Million Crypto Theft Allegations</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

CoinDCX Admits Sweeping Failure After $16 Million Crypto Theft Allegations

Table of Contents

Crypto Adventure

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!