On 22 October 2026 CoinDCX, an Indian exchange, answered reports of large transfers out of addresses linked to the company. Investigators, including Darcy of FlashRescue and the on-chain researcher ZachXBT, had flagged on the order of $16 million, mostly in USDT on Tron, leaving addresses they tied to CoinDCX. The exchange’s first reply said those addresses were created in January 2025, compromised in a July 2025 incident, unused by CoinDCX since, and unconnected to the activity now being described. It said current central and user addresses were not hit.
A later post from the company is the one to keep. Some users had kept sending deposits to those deprecated addresses after CoinDCX told them to use the addresses in the app. The exchange said it regularly sweeps those old addresses, moving the deposits so they can be credited and stored. That sweep failed for a period. CoinDCX said the failure produced operational losses, which the company absorbed, and that every affected deposit had been credited, including deposits sent to the retired addresses. It said customer assets sit in segregated cold wallets, that current addresses were unaffected, and that trading continued. It did not say how much was lost, or how long the sweep had been failing. A company’s “about $16 million” is not in that post. The figure belongs to the investigators. Treat them as two numbers until CoinDCX publishes one.
What happened
The July 2025 incident is the background the exchange itself used. CoinDCX said then that about $44 million left an internal operational account used to provide liquidity on a partner exchange, that customer wallets were separate, and that the company would cover the loss from its own reserves. That was a treasury account at a venue, in the company’s telling. It was not a rewrite of the user ledger on the screen. This October argument is about what happened to deposit addresses after that incident.
ZachXBT’s challenge to the first reply was specific. He said at least one CoinDCX deposit address stayed in use by a liquidity provider for about ten months after July 2025, that it swept user deposits to the exchange’s current public hot wallet, and that it received fee top-ups as recently as April and May 2026. Sumit Gupta, the cofounder and chief executive, replied that the team was investigating and that no user funds would be lost. The later company post is the investigation’s public result: the addresses were not fully abandoned, users could still pay them, and the cleanup job that was supposed to catch those payments stopped working. We will not publish the address. A string in a reply is how a fake “recovery” site gets its first click.
Do not mash this into Bitget’s September hot-wallet drain, or into Bybit’s 2025 theft. Those were the exchange’s spendable float moving under an attacker’s command, in the companies’ accounts. CoinDCX’s October statement says the active wallets did not move, and that the loss was deposits sitting on addresses it had meant to retire. An exchange balance is an IOU, not a wallet. A deposit address is the exchange’s mailbox. Retiring the mailbox in a blog post does not delete it on the chain. If the sweep is down, coins that land there are still the exchange’s problem, or the depositor’s, depending on what the terms actually promise. CoinDCX says it took the loss and credited the accounts. That is a company ledger entry. It is not a chain refund.
Why it matters
If you deposited to a CoinDCX address shown in the app this week, the company’s claim is that you were not on the retired set. If you reused an address from an old email, an old invoice, or a bookmark, you were using a mailbox the exchange says was compromised in 2025 and only sometimes swept. “Credited” means the exchange added the number to your login. It does not mean the coins are in a wallet whose keys you hold. See how crypto wallets actually work. See a practical checklist for keeping crypto safer: nobody who is making you whole needs your recovery phrase, and an address that is not on the deposit screen today is not a place to send coins because it worked last year.
Cold wallets in the company’s sentence are the tier it says was not touched. Segregated is an accounting word. It is not FDIC insurance and not a personal key. If a headline says “CoinDCX was hacked again for $16 million”, it has merged an investigator’s tally, a July 2025 treasury loss, and an October sweep failure into one break-in. The exchange denies the break-in of active wallets. The chain shows old addresses moving. Both can be true. The page you want is the one that says which keys moved.
What happens next
A figure from CoinDCX, or a decision never to publish one. More tracing of where the USDT went, and freezes that will be partial if issuers or exchanges agree to them. A process question the company has not answered in public: how a sweep of known-compromised addresses fails while users can still find those addresses. Watch CoinDCX’s own posts. We will not turn a deposit-address mess into a buy or a sell, and we will not pretend Tron failed because an exchange mailbox did.
Not a review of CoinDCX. Not an instruction to deposit, withdraw, buy, or sell. Not a claim that any particular login was made whole beyond what the company said it credited.
