SECURITY ALERT

UPDATED 13:45 UTC, 22 Oct. CoinDCX changed its account at 11:47 UTC. In a further statement on X, it said some users kept depositing to the deprecated addresses despite past warnings, that its process for regularly sweeping such deposits “failed” for a period it did not specify, and that this was identified on Thursday morning. “This failure led to some operational losses, which were absorbed by CoinDCX,” the exchange said, adding that all affected user deposits were credited and that current central and user addresses were not affected. It did not give the size of the loss. Chief executive Sumit Gupta shared the update; earlier he had told ZachXBT the company was investigating.

The addresses were old, the exchange says.

The ledger shows them still at work.

About 15.99 million USDT left TRON addresses labelled as belonging to the Indian exchange CoinDCX on Wednesday, and had been split across new wallets by early Thursday, according to public TRON records read by CryptoWatchDesk.

CoinDCX says this is not a new breach.

The addresses were created in January 2025, compromised in its July 2025 hack and “have not been used by CoinDCX since”, the exchange said on X at 08:14 UTC on Thursday. “Users’ funds are safe,” it said, and trading continues as usual.

Who was moving money through them this year?

What the record shows

The USDT landed in one address, TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, from 40 addresses on Wednesday afternoon.

  • 21 Oct, 12:33 to 15:20 UTC: 39 addresses send it about 172,000 USDT in small amounts.
  • 21 Oct, 15:35:54 UTC: TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy sends 15,819,002 USDT in one transfer.
  • 21 Oct, 17:05 UTC to 22 Oct, 03:22 UTC: the receiving address sends all of it, about 15.99 million USDT, on to six addresses, the largest share, about 7.1 million, to TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjq.

Darcy, an asset-recovery account that flagged the transfers first, says the funds were then split further and sent to deposit addresses at Binance, OKX and Gate (our translation from Chinese). We have not traced that last step.

The labels are not ours either. CoinDCX co-founder Sumit Gupta says the addresses were tagged by the analytics firm Arkham.

So how long had the big address been retired?

Retired, or still running?

TQKJQ forwarded USDT to TU7BbAsb8t371eMijQeiGXsiLvY1vZbsFs every month from March 2025 to January 2026, and again in April and May 2026, the last time on 4 May, by our reading of TRON records.

In 2026, almost all of its USDT came from a single address, TSC5MzYDNqtp3HDpqCNpTAs5pnT7wt4Hrd. The 15.8 million that left on Wednesday had built up there between January and March.

On-chain investigator ZachXBT replied to CoinDCX that the address was used by an “LP”, a liquidity provider, for 10 months after the July 2025 incident and swept deposits to what he called CoinDCX’s “current public hot wallet”, TU7Bb. A hot wallet is an exchange wallet kept online to pay out withdrawals.

The smaller senders were active recently too. Of the 39 that paid into the receiving wallet before the large transfer, 29 had also sent USDT to TU7Bb earlier this month, and 13 did so on 20 or 21 October, the latest at 12:14 UTC on Wednesday, about three hours before the large transfer.

The record does not show who held the keys to any of these addresses. CoinDCX has not said whether TU7Bb is its wallet.

Gupta said the exchange had checked all its current central and user addresses and that none had sent money to the old ones. The team is still investigating, he said.

What was in those addresses, and whose was it?

The 2025 hack

In July 2025, CoinDCX lost about $44 million from an internal account used for liquidity on a partner exchange, and covered it from its own treasury, it told TechCrunch at the time.

That account was held on a partner exchange. The addresses in Wednesday’s transfers are on TRON, and CoinDCX’s statement on Thursday did not say how they were compromised.

So how far did the July breach reach?

Protect yourself

  • Only send deposits to the address your CoinDCX app shows you at the time, and never reuse an old deposit address saved in another wallet.
  • Check the full address before you send. Attackers create look-alike addresses with the same first and last characters.
  • Treat anyone offering to “recover” funds from this incident as a scammer.

This week has already seen the Railway secrets breach. On TRON, USDT can be frozen by its issuer, as when Tether froze four TRON addresses and then reversed it. For the basics, see what a private key is.

When an exchange retires an address, who checks that nothing still flows through it?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.