India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows

About $16 million in crypto moved from wallets linked to CoinDCX, making the scale large enough to trigger theft concerns. The tokens were USDT, a dollar-pegged stablecoin, and TRX, Tron’s token.

The outflow began with CoinDCX’s hot wallet and several deposit addresses. The funds went to one Tron address, with the largest transfer totaling 15,819,002 USDT. That address then split the assets among several wallets. The precise on-chain movement became central to the dispute over whether this was a fresh exploit.

CoinDCX said the movement involved old addresses compromised in July 2025, not current active wallets. The exchange also said a temporary sweeping failure created operational losses, which it absorbed after crediting affected users. Trading continued, and the exchange said current addresses and customer assets in cold wallets were not hit.

CoinDCX’s explanation was that the $16 million came from old deposit addresses, not its active wallets. It said those addresses had been compromised in July 2025 and abandoned afterward, so the activity reflected hackers reusing them rather than a fresh breach.

The exchange distinguished old and current infrastructure. It said current central and user addresses were unaffected, while customer assets remained in cold wallets. CEO Sumit Gupta called the claims a false alarm, and the company said trading continued as usual.

That explanation mattered because the same outflows looked like a new theft when first flagged. CoinDCX later acknowledged that some users still sent funds to deprecated addresses and that sweeping failed for a period. It credited affected users and absorbed the operational losses, but ZachXBT disputed whether at least one address was truly inactive.

ZachXBT pointed to on-chain activity from an address labeled TQKJQ. He said it remained in use for 10 months after the July 2025 incident, contradicting CoinDCX’s claim that compromised addresses had been abandoned.

His evidence was not just an old balance or isolated transfer. He said TQKJQ continued sweeping user deposits and receiving gas, the small fee needed for token movement. Those funds were then sent as recently as April and May 2026 to CoinDCX’s current public hot wallet.

That pattern suggested an ongoing connection between the supposedly retired address and active exchange infrastructure. It did not, by itself, prove that CoinDCX’s active wallets were hacked, but it challenged the exchange’s timeline and raised questions about how deprecated deposits were handled. CoinDCX said its sweeping process had failed temporarily.

A crypto deposit address is a unique string assigned to a user for receiving funds. A hot wallet is an internet-connected wallet used for everyday withdrawals, while a cold wallet is kept offline for storage. Together, they form an exchange’s movement and storage system.

CoinDCX users send crypto to personal deposit addresses. The exchange regularly sweeps those deposits into main wallets it controls. Some funds move to the hot wallet for routine withdrawals; the rest goes to cold wallets. This centralizes assets while separating frequently used funds from offline holdings.

The arrangement also explains the dispute. A retired address can still receive deposits if users keep using it, and a failed sweep can leave funds there. CoinDCX said current wallets were safe and customer assets were in cold wallets, while investigators tracked transfers from older addresses into newer ones. That separation limits routine exposure.

Users who kept depositing to deprecated addresses were affected when CoinDCX’s sweeping process failed for a period. Their deposits were not automatically moved as intended, creating operational losses and uncertainty over where the funds sat.

CoinDCX said it credited every affected user. It also absorbed the resulting operational losses instead of passing them on, while stressing that users had previously been told not to deposit to compromised addresses. The exchange now describes those addresses as deprecated, or retired.

The response was therefore both financial and procedural. CoinDCX restored users’ credited balances and said current addresses and customer assets in cold wallets were not compromised. Still, the case showed that old addresses can remain active in practice when users continue sending deposits and automated sweeping breaks down for a time.

CoinDCX’s July 2025 hack changed the status of the addresses at the center of the dispute. The exchange said they were created in January 2025, compromised in July, and no longer used afterward. It warned users not to deposit to them.

The exchange labeled those addresses deprecated and said hackers were reusing them. That was the basis for denying a new attack on active wallets. CoinDCX said current central and user addresses were unaffected, and customer assets remained in cold wallets.

The disagreement focused on whether retirement worked in practice. ZachXBT said address TQKJQ still received user deposits, gas, and connections to CoinDCX’s current hot wallet after the hack. CoinDCX acknowledged that some users continued using old addresses and that sweeping failed temporarily in the period, then credited affected users.

Blockchain investigators can start with the sending and receiving addresses, then map the sequence, amounts, tokens, and timestamps on the public ledger. They can compare the destination with known exchange hot wallets, deposit addresses, and prior hack-related addresses. This reveals whether funds followed a normal sweep pattern or moved toward unfamiliar wallets.

In this case, investigators noted that about $16 million in USDT and TRX moved to one Tron address, which split the funds onward. They also tracked TQKJQ receiving user deposits and gas, then sending funds to CoinDCX’s current public hot wallet. Those links challenged the claim that the address was abandoned.

A genuine theft would be more consistent with unauthorized outflows to wallets outside the exchange’s normal control, while internal movement would show established exchange links and routine sweeping behavior. On-chain evidence cannot alone prove who controlled a key or why a transfer occurred, so investigators must compare transaction patterns with the exchange’s explanations and user-credit records.