About 15.99 million USDT moved from wallets linked to the Indian exchange CoinDCX to a single address this week, according to on-chain investigator Darcy. On October 22, CoinDCX said the wallets were old deposit addresses compromised in its July 2025 hack and that customer funds are safe. Investigator ZachXBT says one of those addresses was still feeding CoinDCX's current hot wallet as recently as this spring. Nobody outside the exchange can yet prove which version is right.

Key facts

  • What: About 15.99 million USDT and 5,783 TRX moved on the TRON network to one address; the largest single transfer was 15,819,002 USDT
  • Exchange says: The wallets were created in January 2025, compromised in its July 2025 hack and are no longer in use; customer funds are safe
  • Investigators say: ZachXBT: a flagged deposit address swept funds to the current hot wallet in April and May 2026; Darcy: two proof-of-reserves addresses sent funds to the flagged address
  • When: Flagged and denied on October 22, 2026; CoinDCX says it is investigating
  • Source: CoinDCX statement and co-founder Sumit Gupta's posts, reported by crypto.news and BeInCrypto

Two stories about the same wallets

CoinDCX's version is that the flagged addresses were left over from July 2025, when it lost about $44 million in a hack. In that version the money was the exchange's own and no customer is out of pocket. Co-founder Sumit Gupta said the team checked every current central and user address and found none had sent funds to the flagged wallet. He said the exchange is investigating, and posted, "We assure that no user funds will be at loss."

The investigators' version doesn't fit that neatly. ZachXBT says one of the flagged deposit addresses was still sweeping funds into CoinDCX's current public hot wallet in April and May 2026. Darcy says two addresses listed in CoinDCX's latest proof of reserves sent money to the flagged address. If either point holds up, these aren't purely dead wallets from last year. One report says ZachXBT told users to withdraw. We haven't seen that post ourselves.

What we can't tell you

Whether this is a new breach, a botched cleanup of old wallets or something else isn't settled. Nobody independent has confirmed customer losses. We don't know CoinDCX's full liabilities, so its proof of reserves can't settle this alone. A list of wallets shows what the exchange holds. It doesn't show what it owes.

What an exchange user can do

  • Expect fake "CoinDCX refund" or "verify your account to protect funds" messages. Log in only through the app you already have.
  • If you decide to move coins, send a small test amount first to an address you have checked twice. Do it from the exchange's own withdrawal page, never from a link.
  • Our due diligence checklist covers what to look for before trusting any platform with a balance.

The lesson goes beyond CoinDCX. Keep on any exchange only what you're actively using, and hold the rest in a wallet whose keys you control.

Sources: crypto.news, BeInCrypto, CoinCodex, Coinpedia.