CoinDCX Hack Confirmed: $15.99M Lost From Old Wallets

Steady attention without excessive speculation.

The confirmation followed days of mixed signals. First the exchange denied any theft. Then it blamed a failed automated process that left deposits sitting in compromised addresses.

Inside the CoinDCX Hack

The drain happened on October 21, at around 15:35 UTC. The largest single transfer moved 15,819,002 USDT from deposit address TQKJQ to a newly created receiving address, according to Bitquery.

That wallet had quietly collected about 15.82 million USDT from 88 deposits. The deposits landed between late January and late March 2026, and most of the balance sat untouched until the drain.

The attacker also took roughly 5,784 TRX. From there, the thief split the funds and routed them toward Binance, OKX, and Gate deposit addresses.

From Denial to Admission

CEO Sumit Gupta first called the activity a false alarm. On X, he said the flagged addresses dated to January 2025 and fell in the July 2025 hack. He insisted that current wallets stayed secure.

Hours later, Gupta softened the message. He said the team was investigating and that “no user funds will be at loss.”

On October 22, CoinDCX changed course entirely. In an official X post, it described a routine “sweeping process.” That process had failed for a period, and the team surfaced the problem that morning India time.

The post said the failure “led to some operational losses, which were absorbed by CoinDCX.” It added that the exchange credited affected user deposit wallets, and that customer assets stay in segregated cold wallets.

How the Sweep Failure Caused the CoinDCX Hack

Exchanges run automated sweeps to pull user deposits from many addresses into a few secure wallets. The goal is simple. Fewer live addresses mean a smaller attack surface.

When that sweep stops, deposits pile up in the original addresses instead. Here, the July 2025 hack had already compromised those addresses. So the attacker still held the keys and could sign transactions to move the funds.

The deeper issue is key rotation. A “retired” address stays exposed if the team never rotates the keys and the app layer still accepts deposits. Labeling a wallet retired while sweeps run leaves real residual risk.

On-chain data shows CoinDCX systems were active that morning. According to Bitquery, a routine fee top-up moved about five minutes before the thief’s first transaction.

On-Chain Trail and the Tether Freeze

The stolen funds did not stay in one place. Bitquery tracked downstream splits of roughly $5.5M toward OKX, $2.8M toward Binance, and $1.4M toward Gate.

Tether moved to contain part of the loss. It froze about $2.2 million across several parked addresses on October 22, according to AMLBot.

Bitquery’s investigation traced the full $15.99 million in total. The money sat across the roughly 40 wallets that still saw activity the morning of the drain.

Ties to the July 2025 Breach

The 2025 incident hit an internal operational and liquidity account. An attacker drained about $44 million in minutes, mostly USDT and USDC. CoinDCX then absorbed the loss from its treasury while cold wallets stayed safe.

Indian police later arrested a software engineer over compromised credentials, though his exact role remains unconfirmed. Some analysts also flagged possible Lazarus Group patterns, which CoinDCX has not confirmed.

Those same addresses dated to January 2025 and fell in the July breach. CoinDCX deprecated them and warned users. Yet on-chain analysts say the wallets kept handling deposits well into 2026.

ZachXBT and Community Pushback

On-chain investigator ZachXBT rejected the “false alarm” framing. He wrote that the TQKJQ deposit address served a liquidity provider for 10 months after the July 2025 incident. It still swept user deposits “as recent as April & May 2026.”

In his reading, that meant $15.8 million in user deposits had gone unaccounted for. He later urged users to “withdraw all funds” and accused the co-founders of either lying or negligence.

Separately, analyst SomaXBT claimed that about $70.7 million flowed through the retired wallet over roughly 15 months. CoinDCX has not confirmed that cumulative figure, so treat it as a claim for now.

What’s Next After the CoinDCX Hack

CoinDCX says operations continue as normal. Trading, deposits, and withdrawals stayed open, and the exchange reports no user losses because it credited affected accounts. No major volume drop surfaced in coverage as of October 25.

The company told users to verify current deposit addresses. It also said it plans tighter monitoring of legacy systems. Still, open questions remain. They include how long the sweep failed, why the team never rotated the keys, and whether regulators are now investigating.

For now, the practical step for users is clear. Confirm you deposit only to current, exchange-issued addresses, and treat old ones as dead. None of this is financial advice.