Was CoinDCX Hacked Again? The $16 Million Wallet Transfers Explained, and What Users Should Do Now

What happened, in order

21 October. Funds left a hot wallet and several deposit addresses that blockchain analytics had labelled as CoinDCX. According to Coin Edition, citing an on-chain alert, about 15.99 million USDT and 5,783.81 TRX went to a single address on the TRON network, which then split smaller amounts towards addresses linked to Binance, OKX and Gate.

22 October. On-chain investigator Darcy flagged the transfers publicly on X. Because the addresses carried CoinDCX labels, the alert read like a second breach, and "CoinDCX hack" coverage spread quickly through Indian and crypto media.

CoinDCX's first answer. The exchange said the flagged addresses were created in January 2025, compromised in July 2025 and had not been used by CoinDCX since. Chief executive Sumit Gupta wrote that the team had checked its current central and user addresses, that none had sent funds to the flagged wallets, and that the exchange publishes its active addresses in its proof-of-reserves report.

The pushback. Blockchain investigator ZachXBT disputed the "not used since" account. He said deposit address "TQKJQ" was used by a liquidity provider for about ten months after the July 2025 incident, sweeping user deposits into CoinDCX's current public hot wallet and receiving funds for transaction fees as recently as April and May 2026, which in his view meant $15.8 million in user deposits had gone unaccounted for. Gupta replied that the team was aware, was investigating, and that "no user funds will be at loss".

CoinDCX's second answer. Later on 22 October, CoinDCX said some users had kept depositing crypto to addresses compromised in July 2025, despite warnings to stop. It normally moves deposits out of those old addresses to secure them, but that process had failed for an unspecified period. The statement, posted at 11:47 UTC, says the failure "got identified today morning" and that "this failure led to some operational losses, which were absorbed by CoinDCX." It adds that all affected deposits were credited to users even though they went to deprecated addresses, that current central and user addresses were not affected, that customer assets remain in segregated cold wallets, and that trading continues as usual.

Hack or not? How to read the two versions

The two explanations are less far apart than the headlines suggest. Both sides agree the addresses were compromised in July 2025, not this week. The disagreement is about what CoinDCX did with them afterwards. If old deposit addresses stayed active, then money users sent to them sat at addresses the attacker could still reach, and a failed sweep gave the attacker time to take it. That is not a new break-in of CoinDCX's current systems, but it is a real loss caused by keeping compromised addresses in circulation.

SponsoredBinance

Partner rebate share25%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: 11350287

Sign up on Binance →

CoinDCX says it covered that loss. Nobody outside the company can yet confirm the exact amount it absorbed, how long the sweep failed, or how many users deposited to the old addresses. CoinDCX has said an update is coming, and those are the numbers worth watching for.

For context, the July 2025 breach cost about $44 million. At the time CoinDCX said customer wallets were separate from the affected account and that it would cover the loss from its own treasury reserves.

The key facts in one table

What CoinDCX users should do now

1. Get a fresh deposit address every time. The money at risk this week was sent to old addresses. CoinDCX's own statement warns that deposits to deprecated addresses are "highly risky" and that exchanges do not typically take liability for them; this time it credited users anyway, but you should not count on that. Before any deposit, open the app, choose the coin and network, and copy the address shown on screen at that moment. Delete old CoinDCX addresses saved in other wallets, exchanges or address books.

2. Check your recent deposits. Open your deposit history and make sure every transfer you sent in the past weeks shows as credited. If you sent funds to an older address and do not see them, contact CoinDCX support with the transaction hash. The exchange says all affected deposits have been credited, so anything missing is worth raising now.

3. Compare addresses with the proof-of-reserves list. CoinDCX says it publishes its active wallet addresses in its proof-of-reserves report. If a deposit address you were given does not appear to belong to the exchange's current set, ask support before sending anything.

4. Lock down withdrawals. Turn on two-factor authentication and, if your account offers it, a withdrawal address whitelist. Neither would have changed this week's event, but both limit damage if your own login is ever exposed.

5. Do not chase "recovery" offers. Incidents like this attract fake support accounts and recovery services on X and Telegram. CoinDCX will never need your password or 2FA code to credit a deposit.

Should you keep funds on one exchange?

This week's story is a reminder that an exchange's address hygiene matters as much as its headline security. A sensible habit for any trader is to avoid keeping everything on one venue, to keep long-term holdings in a wallet you control, and to look at each exchange's reserve reports and withdrawal record before choosing where to hold larger balances. Our exchange list puts 25 venues side by side with their fees, KYC checks, official domains and deposit methods (card, local bank or P2P), and every entry opens a full profile, for example the Binance profile. If you mostly move USDT on TRON, the network used in this case, the exchange list also lets you filter venues by how you fund the account before you compare deposit and withdrawal costs.

What we could not verify

We read the posts by CoinDCX, Sumit Gupta and ZachXBT through a read-only copy of X; the transfer amounts come from the on-chain alert as reported by Coin Edition, and we did not trace the TRON transactions ourselves. The exact sum CoinDCX absorbed, the length of the sweep failure and the number of affected users have not been published.

Quick answers

Was CoinDCX hacked again in October 2026? CoinDCX says no: the $16 million moved from addresses compromised in July 2025. It has admitted a failed sweep of those addresses caused losses, which it says it absorbed.

Are CoinDCX user funds safe? The exchange says all affected deposits have been credited, its current wallets are unaffected and customer assets sit in segregated cold wallets. Independent confirmation of the loss amount is still pending.

How much was moved? About 15.99 million USDT and 5,783.81 TRX on the TRON network on 21 October, according to on-chain data cited by Coin Edition.

What should I do if I deposited to an old CoinDCX address? Check your deposit history, and if the funds are not credited, contact support with the transaction hash.

How big was the 2025 CoinDCX hack? About $44 million, in July 2025.