CoinDCX said in a statement on X on October 22, 2026 that users’ funds are safe. Researcher Darcy flagged about $16 million in transfers from addresses labeled as belonging to CoinDCX, and ZachXBT disputes the exchange’s account.
Key Facts
- CoinDCX says the flagged wallets are old addresses created in January 2025 and unused since they were compromised in July 2025.
- The funds were split across wallets and reached deposit addresses on Binance, OKX, Gate and other exchanges, according to Darcy.
- A CoinDCX deposit address linked to a liquidity provider remained active for 10 months after the July 2025 hack, according to ZachXBT.
- Address TQKJQ swept funds to CoinDCX’s current public hot wallet as recently as April and May 2026, per ZachXBT.
- CoinDCX co-founder and CEO Sumit Gupta says the exchange is investigating and will share an update soon.
What Happened?
CoinDCX’s reported hot wallet and several deposit addresses sent funds to one TRON address, according to Darcy’s post on X. The transfers came late on October 21 (UTC+8). The outflow totaled roughly 15.99 million USDT and 5,783.81 TRON (TRX). The largest single transfer moved about 15.82 million USDT.
CoinDCX rejected the reading in its own post. The exchange said: Claims circulating on X regarding certain wallet addresses and transactions are misleading. It added that the addresses were compromised in July 2025 and have not been used by CoinDCX since.
Gupta replied to Darcy in under three hours. Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours, he wrote.
He said Arkham had tagged the addresses to CoinDCX, though the exchange generated them in January 2025. He added that the team checked every current central and user address and none had sent funds to the flagged addresses.
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours. The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses. All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised. Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.
— Sumit Gupta (@smtgpt) October 22, 2026
ZachXBT says the old address kept working into 2026
ZachXBT challenged CoinDCX’s account with a transaction screenshot. He said $15.8 million in user deposits remained unaccounted for. The screenshot shows a 15.819 million USDT movement on October 21, 2026 from the TQKJQ deposit address. He said the address continued sending user deposits to CoinDCX’s current public hot wallet and receiving funds to pay transaction fees.
Gupta answered directly. “Yes, aware of that. We’re investigating it further, and will share an update soon“, he wrote.
He added: “We assure that no user funds will be at loss.“
Darcy added that two addresses listed in CoinDCX’s latest proof of reserves had sent funds to the flagged Tron address. That sits directly against Gupta’s statement that no current address sent funds. Both claims can be tested, because Gupta said all CoinDCX addresses are public on its proof-of-reserves page.
The 2025 loss involved a liquidity wallet too
CoinDCX lost about $44.2 million in the July 2025 breach. Gupta said at the time that attackers hit an internal wallet used for liquidity on a partner exchange, and customer funds stayed safe. The exchange also said it would cover the loss from its treasury reserves.
ZachXBT’s challenge touches the same category of infrastructure. Both the 2025 loss and the contested address involve liquidity-provider arrangements, though ZachXBT says the address carried user deposits. That makes one factual question decisive: which addresses stayed live after the breach, and who controlled them. F
Gupta said CoinDCX’s official accounts will share more details soon. The disagreement now turns on records only CoinDCX holds: which deposits passed through TQKJQ after July 2025, and where they went. Until the exchange publishes its update, its denial and the investigators’ claims stand unresolved.
