TL;DR
- CoinDCX denied a new breach after investigators flagged about $16 million moving from addresses historically linked to the exchange, saying current wallets and user funds remain safe.
- The exchange says the addresses were compromised during its July 2025 incident, while blockchain investigators dispute whether at least one remained operational into 2026.
- Onchain transfers confirm asset movement but do not prove unauthorized access, customer losses or who controlled the wallets involved.
CoinDCX denied a new security breach after blockchain investigators flagged $16 million in transfers from addresses associated with the Indian exchange. In an official statement, the company said the claims were misleading and that user funds remained safe. The disputed activity involves old wallet addresses, while CoinDCX says its current wallets were not compromised. The episode highlights custody and counterparty risks that distinguish centralized exchanges from decentralized trading platforms.
Further update on the TQKJQ wallet On-Chain activity.
Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been…
— CoinDCX (@CoinDCX) October 22, 2026
Investigators Challenge CoinDCX’s Wallet Timeline
Onchain researcher Darcy flagged approximately 15.99 million USDT and 5,783.81 TRX moving from addresses labelled as linked to CoinDCX. The funds were consolidated into a TRON address before being distributed across wallets, with some transfers traced toward exchange deposit addresses. The blockchain confirms that the assets moved, but it does not establish who controlled the source addresses or whether the transfers were unauthorized. That limitation matters when interpreting exchange wallet labels and proof-of-reserves transparency.
CoinDCX co-founder Sumit Gupta said the addresses were created in January 2025 and compromised during the exchange’s July 2025 security incident. He maintained that current wallets had not sent funds to the flagged addresses and pointed to CoinDCX’s public reserve addresses. Under the exchange’s account, the latest movements reflect activity involving previously compromised wallets rather than a fresh breach of its present infrastructure. The distinction follows a year in which crypto security incidents remain frequent despite lower aggregate losses.
Blockchain investigator ZachXBT challenged that explanation, arguing that one deposit address identified in the dispute continued handling funds after the July 2025 incident, including activity into 2026. That claim raises questions about when the address stopped functioning within CoinDCX’s operational setup. Continued historical activity could weaken the description of the wallet as immediately deprecated, but it still does not by itself prove a second hack. Additional attribution, internal wallet records or a fuller incident timeline would be needed to resolve the discrepancy.
CoinDCX said it is investigating the activity and plans to provide further public details. The exchange previously suffered a July 2025 incident involving an internal operational wallet, while maintaining that customer assets were segregated and unaffected. For now, the confirmed development is a dispute over wallet attribution and control, not proof that CoinDCX’s active custody systems lost $16 million. The episode underscores why exchanges emphasize layered controls, incident response and verifiable security frameworks alongside reserve disclosures.
