CoinDCX says a failed process for collecting deposits from retired wallets caused an operational loss after about $16 million in USDT moved from addresses linked to the exchange on October 21. It says customer balances were protected, but blockchain investigators have questioned parts of its timeline.
The dispute concerns whether the addresses were dormant after CoinDCX’s July 2025 security incident. The exchange initially described the transfers as activity involving previously compromised addresses that were no longer in use. It later said a routine process for sweeping deposits from deprecated addresses had failed for a period and that it would absorb the resulting losses.
What investigators traced on-chain
Bitquery’s on-chain investigation and Moneycontrol’s reporting describe approximately 15.99 million USDT moving from a group of TRON-network addresses into a newly created address on October 21. Bitquery identified 40 wallets associated with the incident and said about $9.63 million reached deposit addresses at OKX, Binance and Gate within roughly a day.
The largest reported transfer was approximately 15.82 million USDT from an address identified in the investigation as TQKJQ. These records establish token movements between addresses, but they do not independently show how CoinDCX credited individual customers or prove who controlled each wallet at every point in time.
CoinDCX’s explanation
In a public statement on X, CoinDCX said the wallets were created in January 2025 and compromised during the July 2025 incident. The exchange initially said the addresses had not been used since that incident.
The company later said some customers continued sending funds to deprecated addresses despite warnings to use the latest addresses displayed in its app or website. CoinDCX said its process for collecting deposits received at old addresses failed for a period and that it would cover the resulting operational losses. It also said affected deposits had been credited, customer assets remained in segregated cold wallets and active wallets were not compromised.
These points are CoinDCX’s statements. The public posts do not provide a complete customer-level reconciliation that outside observers can independently verify.
Where the timeline remains disputed
On-chain investigator ZachXBT challenged the exchange’s account, arguing that address TQKJQ continued to receive gas funding and route deposits toward a wallet associated with CoinDCX in April and May 2026. Bitquery’s analysis also describes transactions it interprets as routine deposit sweeps before the October transfers.
This is the main unresolved disagreement. Blockchain records can establish when tokens moved, but they cannot reveal whether a deposit was reconciled in the exchange’s internal books or how a particular customer account was credited. A detailed reconciliation and explanation of the sweeping process would help clarify the timeline.
What is confirmed and what remains unclear
- On-chain activity: roughly 15.99 million USDT moved from addresses identified by investigators as linked to CoinDCX on October 21, 2026.
- CoinDCX’s account: a deposit-sweeping process failed for a period, the company would absorb the resulting losses, and affected customer accounts were credited.
- Investigators’ claim: transaction patterns suggest that some addresses continued to be used for deposit-related activity after the 2025 incident.
- Still unresolved publicly: the internal status of each customer deposit, the full duration and cause of the process failure, and wallet control at the time of the transfers.
What users should do
CoinDCX customers should confirm deposit instructions in the official app or website before transferring funds and avoid reusing saved addresses without checking that they remain current. Anyone concerned about an account should contact official support and retain transaction IDs, timestamps and relevant account records.
The incident illustrates the limits of transaction tracing: public ledgers show where tokens moved, while customer-level reconciliation depends on exchange records and other evidence.
Sources
- CoinDCX’s public statement
- ZachXBT’s response
- Bitquery’s on-chain investigation
- Moneycontrol’s report
- CoinDCX’s July 2025 incident report
Related Reading
For practical background on wallet records and transaction tracing, see What Is a Crypto Wallet? A Beginner’s Guide and How to Use a Blockchain Explorer.
This report separates the exchange’s statements from third-party analysis. It will require updating if new evidence materially changes the timeline. It is for informational purposes only and is not financial advice.
