CoinDCX says the $16 million USDT move is an old hack’s leftovers; ZachXBT says the address was in use until May

CoinDCX, India’s largest crypto exchange, denied on Thursday 22 October that it had suffered a new hack, after an on-chain alert said about 15.99 million USDT had left its wallets on the TRON network the day before. Co-founder Sumit Gupta wrote on X at 08:10 UTC that “CoinDCX wallets are not breached” and that the addresses involved were compromised in the July 2025 CoinDCX hack; the exchange added that they had not been used since. Less than an hour later, investigator ZachXBT replied that one of those addresses was still sweeping user deposits in April and May 2026.

The transfers themselves are not in dispute. Coindaro checked the receiving address on TRON’s public ledger: it took in 15,991,414 USDT, including a single transfer of 15,819,002 USDT at 15:35:54 UTC on 21 October, and had sent all of it on by 03:22 UTC the next morning. What the ledger does not say is who controls the addresses on either side, or whether any customer lost money. Those are the points the exchange and its critics disagree on, and neither side has yet published proof that settles them.

The alert: 15.99 million USDT into one fresh TRON address

The first warning came from Darcy, who posts as @DarcyAri and is described by Crypto Briefing as an executive at the security firm Salus. In a post in Chinese published at 05:30 UTC on 22 October, Darcy said CoinDCX was suspected of having lost about 15.99 million USDT and 5,783.81 TRX. According to the post, the hot wallet of the exchange and several of its deposit addresses sent those funds to the TRON address TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, the largest single transfer being 15,819,002 USDT.

Darcy gave the time of that transfer as 23:35:54 in UTC+8, which is 15:35:54 UTC on 21 October. The receiving address then split the money across several wallets, and part of it reached deposit addresses at Binance, OKX, Gate and other exchanges, according to the reports of Crypto Briefing and crypto.news on the alert. Coindaro did not trace the funds that far.

The word that matters in the original post is “suspected”. crypto.news noted that the alert alone does not prove the transfers were unauthorised. It shows money moving from addresses that blockchain analytics tools, Arkham Intelligence among them, had labelled as CoinDCX’s.

What the TRON ledger shows at the time of writing

Coindaro read the history of the receiving address through the public TronGrid and Tronscan interfaces on 22 October, between about 10:50 and 11:00 UTC. The address is new. It was created on 21 October at 12:19:30 UTC, about three hours before the large transfer, and anyone can follow it on Tronscan.

Between 12:33 and 15:20 UTC it received 44 small USDT transfers, from 0.01 USDT to about 35,456 USDT each. The biggest group arrived in under five minutes, between 15:00:27 and 15:05:06 UTC: 27 transfers from 27 different addresses, most of them nine seconds apart. That rhythm is what a script looks like when it sweeps a batch of deposit addresses into one place. Exchanges run such sweeps every day to gather customer deposits. So can anyone who holds the private keys of those addresses.

At 15:35:54 UTC came the big one: 15,819,002 USDT from the address TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy, the one ZachXBT later called “TQKJQ”. Two more transfers, of 1 and 3 USDT, arrived later from another address. In all, the receiving address collected 15,991,414 USDT in 46 transfers, which matches Darcy’s figure of about 15.99 million. Coindaro did not check the TRX part of the alert.

The money did not stay long. At 17:05 UTC on 21 October the address sent a 10 USDT test payment, then 2 million USDT two minutes later. By 03:22 UTC on 22 October it had sent out all 15,991,414 USDT in 18 transfers to six addresses, first in blocks of 1 million to 3 million, then in amounts from 20,000 to about 2.14 million. That pattern fits funds being split and routed onward. It says nothing, on its own, about who is doing the routing.

One limit applies to every line of that table. No public explorer label ties any of these addresses to CoinDCX. The attribution comes from Arkham’s tags, from Darcy and ZachXBT, and from CoinDCX itself, which accepts that the addresses were once its own. The figures are those of 22 October at about 11:00 UTC, when the receiving address held no USDT.

CoinDCX and Sumit Gupta: old addresses from the July 2025 hack

CoinDCX answered from its official account at 08:14 UTC on 22 October. “Users’ funds are safe,” the exchange wrote, calling the claims about certain wallet addresses “misleading”. It said the transactions involved old addresses created in January 2025, compromised in July 2025 and not used since, according to the post and to Crypto Briefing’s account of it. Trading continues as usual, the exchange added.

Sumit Gupta had responded to Darcy’s alert four minutes earlier. “Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached,” he wrote, adding “Pls don’t spread rumours.” The addresses tagged by Arkham, he said, belonged to CoinDCX before the July 2025 hack, were generated in January 2025 and were compromised during that incident.

According to crypto.news, which reported the rest of the post, Gupta said the attackers of July 2025 appear to be reusing those addresses, and that CoinDCX found no transfer from its current operational or customer addresses to the flagged ones. He pointed to the exchange’s public proof of reserves and said more details would follow as the investigation went on. The Defiant summed up his position the same way: the flagged addresses were compromised in July 2025, and no funds from CoinDCX’s current wallets were affected.

ZachXBT says the TQKJQ deposit address was in use until May 2026

At 08:52 UTC, ZachXBT, the on-chain investigator who reported the July 2025 attack before the exchange did, addressed CoinDCX directly. He wrote that the deposit address TQKJQ “was in use by a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">LP for 10 months” after the July 2025 incident, LP meaning a liquidity provider. According to him, it swept user deposits and received gas, the TRX needed to pay network fees, as recently as April and May 2026, and sent funds to CoinDCX’s current public hot wallet.

His conclusion is the opposite of the exchange’s. “Meaning $15.8M in user deposits was unaccounted for by your team,” he wrote. A screenshot attached to the post shows, according to crypto.news, the transfer of 15,819,002 USDT on 21 October. That part Coindaro could confirm on the ledger: TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy did send exactly that amount at 15:35:54 UTC.

Coindaro then read the full USDT history of TQKJQ on Tronscan: 1,381 transfers between 27 March 2025, when it received its first USDT, and 21 October 2026. The address took in and forwarded USDT in every month from March 2025 to May 2026, before and after the July 2025 hack. Its last incoming transfer arrived on 4 May 2026. Of its outgoing transfers, 610 went to a single address, TU7BbAsb8t371eMijQeiGXsiLvY1vZbsFs. No public label on Tronscan says who owns that address, so Coindaro cannot confirm ZachXBT’s description of it as CoinDCX’s current hot wallet.

The ledger also shows where the 15.8 million came from. Until late January 2026, TQKJQ passed on what it received. Then it stopped: in February and March 2026 it took in 15,478,002 USDT in 82 transfers, all from one address, TSC5MzYDNqtp3HDpqCNpTAs5pnT7wt4Hrd, and sent nothing out. Its balance reached 15,819,002 USDT on 30 March 2026 and did not move until 21 October, while the smaller deposits of April and May were forwarded as before. The chain does not show whose money that was, or whether the sender was a customer, a liquidity provider or someone else.

CoinDCX said the flagged addresses were created in January 2025; on TRON, an address can be generated well before it receives its first funds. When crypto.news published, CoinDCX had not explained how the address history ZachXBT cited fits with its own account.

What is established, and what is not

Five points can be checked by anyone on the ledger.

• A new TRON address received 15,991,414 USDT on 21 October, mostly through one transfer of 15,819,002 USDT at 15:35:54 UTC.
• The sender of that transfer is the address ZachXBT calls TQKJQ, which Arkham’s tags, cited by Gupta, link to CoinDCX.
• CoinDCX and its co-founder accept that the flagged addresses were once the exchange’s, and say they were compromised in July 2025.
• TQKJQ kept receiving and forwarding USDT until May 2026, and the 15,819,002 USDT it sent had sat on it since 30 March 2026.
• The funds were split and sent onward within about 12 hours.

What nobody has shown publicly yet is who controls the receiving address and the addresses that sent to it. Nor has anyone shown whether customers lost money. CoinDCX says no; ZachXBT says $15.8 million in user deposits went unaccounted for. Then there is the question of time. The exchange says the address has not been used since July 2025; the ledger shows that someone kept using it, and that the 15.8 million arrived in 2026, long after the hack. Whether that someone was CoinDCX, a liquidity provider working for it or the July 2025 attacker is what the two sides dispute.

We found no statement from an Indian regulator or from the police on the new transfers, and no independent review of CoinDCX’s explanation, at the time of writing. No one has been accused of wrongdoing by any authority in this case.

The July 2025 CoinDCX hack: $44.2 million from an operational account

The addresses at the centre of the dispute go back to the attack CoinDCX disclosed on Saturday 19 July 2025. An internal operational account, used to provide liquidity on a partner exchange, was compromised and about $44.2 million was taken, TechCrunch reported at the time. The exchange said customer funds were not affected and that it would absorb the loss from its own treasury reserves.

“The incident was quickly contained by isolating the affected operational account,” Gupta said then, adding that the account was “segregated from customer wallets”. CoinDCX said it was working with CERT-In, India’s computer emergency response team, and offered a bounty of up to 25% of any recovered funds, capped at $11 million according to crypto.news.

ZachXBT had reported that loss too, hours before the exchange confirmed it. According to him, the attacker’s address had been funded with 1 ETH through the Tornado Cash mixer; part of the funds was bridged from Solana to Ethereum and consolidated into 4,443 ETH and 155,830 SOL, which were dormant when TechCrunch reported on 21 July 2025.

The episode came a year after WazirX, another Indian exchange, lost $230 million in a hack in July 2024. CoinDCX later set up a customer protection fund of about $6 million plus 2% of its brokerage income, according to crypto.news. TechCrunch put CoinDCX’s user base at more than 16 million, with over 500 assets listed. For scale, our report on crypto hacks in the third quarter of 2026 counts $1.18 billion stolen in those three months.

Why a compromised address is never really abandoned

CoinDCX’s explanation rests on a simple idea that newcomers often miss. On a blockchain, an address does not close. Whoever holds its private key can move whatever lands on it, forever. When a key leaks in a hack, the exchange can stop using the address, but it cannot take the address back. Anything sent there later, by a customer who saved an old deposit address or by an automated system that was never switched off, is at the mercy of the attacker.

That is why the timing in ZachXBT’s post weighs so much. Exchanges give each customer a deposit address, then sweep the balances of thousands of those addresses into a central hot wallet. If a compromised deposit address stayed in that cycle for months after a hack, two parties could have held its key at once, and new deposits could have been exposed. If it was taken out of service in July 2025, the question becomes who sent 15.5 million USDT to it in early 2026, and why.

TRON makes such flows easy to follow and fast to scatter. It carries a large share of USDT payments, as our piece on the $2.2 trillion in stablecoins TRON moved explains. Tether, the issuer of USDT, can freeze tokens at an address, but nothing shows that anyone asked it to in this case.

Is CoinDCX safe? What a user can check today

Nobody outside the exchange can answer that from the chain alone, and this is not advice to buy, sell or withdraw. A customer can still look at a few concrete things. One is the proof of reserves Gupta cited: it is only useful if it lists wallet addresses that can be checked on an explorer and sets them against customer balances on a stated date. Another is whether the exchange keeps customer funds separate from the operational accounts it uses for trading and liquidity, the very separation CoinDCX said protected users in July 2025.

When an exchange says flagged addresses are old, the address history is the test. A user can open the address on Tronscan and look at the date of its last incoming transfer: for TQKJQ, that is 4 May 2026. Our guide on how to choose a crypto exchange lists the other points worth checking, from licences to security record.

CoinDCX serves the Indian market and is not licensed under MiCA in the European Union, so the AMF in France or Consob and OAM in Italy have no role in this case.

What to watch next

The next step belongs to CoinDCX. The exchange has not yet said who sent USDT to TQKJQ after July 2025, or who controls the address that received most of its outgoing transfers. Gupta said more details would follow. A wallet-by-wallet reply to ZachXBT, an updated proof of reserves or a statement to CERT-In would each move the story forward. On the chain, the onward addresses that received the split funds are the ones to follow: a deposit at Binance, OKX or Gate could let those platforms freeze funds if CoinDCX or law enforcement asks them to.