CoinDCX wallet transfers involving about $15.99 million in USDT on October 21, 2026, have prompted a dispute over whether the Indian cryptocurrency exchange suffered another security breach. CoinDCX says the flagged addresses were abandoned after its July 2025 hack, while blockchain investigators say transaction records show continued operational activity.
Key Takeaways
- CoinDCX denies a fresh breach and says customer funds and trading services remain unaffected.
- Bitquery identified activity across 40 TRON wallets that it says challenges the exchange’s explanation.
- The transfers do not yet establish a separate unauthorized loss or whether customer balances were affected.
Table of Contents
- CoinDCX wallet transfers raise questions about retired addresses
- Investigators point to recent deposit-processing activity
- What transaction records cannot settle
- Conclusion
CoinDCX wallet transfers raise questions about retired addresses
Blockchain investigator Darcy initially flagged the October 21 movements, which involved approximately 15.99 million USDT and 5,783.81 TRX. The assets moved from addresses identified as associated with CoinDCX to a receiving address on TRON before being distributed across other wallets.
CoinDCX chief executive and co-founder Sumit Gupta disputed suggestions that the exchange’s current infrastructure had been compromised. The company said the addresses were created in January 2025, compromised during the July 2025 incident and no longer used for operational purposes.
CoinDCX also maintained that customer funds remained secure and that trading and investment services continued normally. Those assurances are the exchange’s position; the available transaction records do not independently establish the condition of customer account balances.
| Item | Details |
|---|---|
| OKX-linked deposit addresses | Bitquery traced approximately $5.46 million in USDT as of its October 22 assessment. |
| Binance-linked deposit addresses | Bitquery recorded approximately $2.61 million net of funds subsequently sent back out. |
| Gate-linked deposit address | Bitquery traced approximately $1.39 million in USDT. |
| Seven recipient-side wallets | Bitquery reported approximately $2.28 million remaining at 12:15 UTC on October 22. |
Investigators point to recent deposit-processing activity
In an investigation with figures verified on October 22, Bitquery examined 40 TRON wallets linked to CoinDCX. It reported 276 fee top-ups associated with deposit processing since August 2026 and routine activity involving one wallet approximately five minutes before the suspicious transfers began.
These details matter because fee payments can enable deposit addresses to move USDT into an exchange’s collecting wallet. Bitquery interpreted the repeated top-ups and subsequent deposit movements as evidence of an operating system, rather than addresses left unused since the earlier breach.
The largest identified transfer was approximately $15.82 million in USDT from one address. Bitquery said about $9.63 million subsequently reached deposit addresses associated with OKX, Binance and Gate within 18 hours. That tracing does not establish wrongdoing by those exchanges or identify the ultimate owners of the receiving accounts.
Blockchain investigator ZachXBT also questioned CoinDCX’s explanation, pointing to activity involving addresses allegedly associated with customer deposits after the July 2025 breach.
What transaction records cannot settle
Bitquery’s discussion of the limits of on-chain wallet analysis distinguishes visible transfers from customer balances recorded in an exchange’s own books. Wallet activity alone cannot conclusively establish whether every movement was unauthorized, who ultimately controlled each address or whether deposits had already been credited to customers.
The earlier July 2025 breach involved an internal operational account used for liquidity provisioning on a partner exchange. CoinDCX estimated its exposure at approximately $44 million and said corporate treasury reserves would absorb the loss, with segregated customer cold-wallet assets unaffected.
The October movements therefore should not be added to the earlier loss as a confirmed cumulative theft of roughly $60 million. Establishing a separate loss requires evidence about authorization, asset ownership and the exchange’s corresponding liabilities.
Conclusion
The next material evidence would be a reconciliation of the affected wallets with CoinDCX’s internal accounts, including whether the transfers were authorized and whether any customer liabilities remain. No such resolution is established in the available information.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
