CoinDCX denies second breach as ZachXBT disputes wallet explanation

What happened

CoinDCX rejected suggestions that it had suffered a second security breach on Oct. 22, after on-chain investigator Darcy flagged transfers of about 15.99 million USDT and 5,783.81 TRX on the TRON network. Darcy said the funds moved on Oct. 21 from wallets identified as CoinDCX deposit and hot wallets to a separate TRON address, with the largest single transfer of 15,819,002 USDT later split across multiple wallets. The reports noted that the transfers alone did not establish that they were unauthorized or that the receiving wallets belonged to an attacker. CoinDCX co-founder and CEO Sumit Gupta said the exchange's wallets had not been breached and that the flagged addresses dated from January 2025 and were compromised in the July 2025 incident, suggesting attackers might be reusing them.

ZachXBT then disputed that account. He alleged that a deposit address beginning TQKJQ stayed in use for roughly 10 months after the July 2025 breach, continued receiving deposits and gas transfers as recently as April and May 2026, and sent funds to wallets publicly identified as CoinDCX's current hot wallets. He also alleged that about $15.8 million in user deposits was unaccounted for. Gupta replied that the team was investigating and said no user funds would be lost. CoinDCX maintained that its current central and user addresses were untouched and that customer assets were held in segregated cold wallets.

Hours later, CoinDCX gave a fuller explanation. It said some users had continued sending crypto to addresses retired after the July 2025 hack, and that a routine process for sweeping those deposits into secure custody had failed for a period. The exchange said it discovered the failure on the morning of Oct. 22 India time, credited affected customer deposit wallets, and absorbed the resulting operational losses itself. It did not disclose the size of the losses, how long the sweep was down, or how many users were affected. It also did not say whether the 15,819,002 USDT transfer was part of those losses.

Why it matters

The dispute puts fresh scrutiny on how CoinDCX handles addresses tied to its July 2025 security incident. The exchange is one of India's largest, and the earlier breach drained about $44 million from an internal account. Its initial insistence that the old addresses were no longer connected to CoinDCX, followed by an acknowledgment that deposits to those addresses had accumulated during a failed sweep, has drawn criticism from investigators who say the public timeline is incomplete. For users, the central question is whether funds sent to retired addresses were properly credited and whether current wallets remain insulated.

What the data shows

On-chain records reviewed by CryptoSlate and reported by Unchained show a transfer of 15,819,002 USDT from the address beginning TQKJQ at 4:35:54 p.m. BST on Oct. 21, equivalent to 11:35 a.m. ET. The receiving wallet had been created about three hours earlier, and by 11:22 p.m. ET it had passed on all the USDT it received, according to Unchained. Chain data cited in the reports show TQKJQ's first activity on March 27, 2025, with incoming USDT transfers continuing until May 4, 2026. The records confirm the tokens moved but do not establish who controlled either address or whether customers lost money.

Background

CoinDCX's July 2025 incident involved roughly $44 million taken from an internal liquidity account. The exchange said at the time that operational wallets were separate from customer custody and that its treasury covered the loss. Security firm Cyvers linked the incident to the Lazarus Group, according to CryptoSlate, and Gupta's preliminary explanation pointed to social engineering after a company laptop was compromised. The episode followed the $230 million WazirX hack, which raised broader questions about how Indian exchanges handle losses from security failures.

What is still unclear

Several key points remain unresolved. CoinDCX has not quantified the operational losses or the period during which its deposit sweep failed. It has not reconciled its explanation with ZachXBT's claim that TQKJQ interacted with its current hot wallets after July 2025. Nor has it confirmed the $15.8 million figure. The exchange has also not said whether it will continue crediting deposits sent to deprecated addresses, though it warned users to verify addresses in its app or website and noted that exchanges typically do not take liability for such deposits.

What to watch

CoinDCX said its investigation is continuing and that further information would come through official channels. The next public markers are whether the exchange quantifies the losses, identifies the period when the sweep failed, and reconciles its account with the TRON transaction history cited by ZachXBT, including the path of the 15,819,002 USDT transfer.

Questions readers ask