CoinDCX $16M Hack Claim: Investigators Challenge Exchange Account

Blockchain investigators are publicly disputing CoinDCX’s account of a reported $16 million security incident, alleging the Indian crypto exchange has misrepresented the origin and timing of suspicious wallet activity flagged on October 22, 2026. The dispute centers on a TRON-based deposit address and whether funds that moved through it after a disclosed July 2025 hack were adequately accounted for or were quietly swept without disclosure to users.

What Blockchain Investigators Allege About the Reported CoinDCX Hack

Investigator Darcy, working with security research group Salus, flagged roughly $16 million in suspicious movements from addresses suspected to be linked to CoinDCX’s custody infrastructure. For related coverage, see Best Crypto Casinos for Halloween 2026: Live Events, Spooky Slots, and Real Bonuses.

On-chain claim

$16 million

The focal point is a TRON-based wallet identified by the string TQKJQ. According to on-chain investigator ZachXBT, this deposit address remained in active use by a liquidity provider for ten months after CoinDCX’s publicly disclosed July 2025 security incident, which the exchange has previously acknowledged. ZachXBT also noted the address received gas and swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026. For related coverage, see BULK Trade Review 2026: Wallet Connection, Trading Experience, and AURA Farming Strategy.

ZachXBT published the following on X, directing the claim at CoinDCX directly:

CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.

Meaning $15.8M in user deposits was unaccounted for by your team.

Why are Indian… pic.twitter.com/S8WYtGNIjz For related coverage, see How Instant Crypto Swaps Work in 2026: Mechanisms, Routing, and Risk.

— ZachXBT (@zachxbt) October 22, 2026

Source: @zachxbt on X

ZachXBT characterized $15.8 million in user deposits as unaccounted for by CoinDCX’s team. This figure represents his on-chain interpretation of the TQKJQ wallet activity and has not been independently audited or confirmed through a third-party forensic review.

Investigator estimate

$15.8 million

What remains unverified

The core allegation, that the October 2026 movements constitute a new or ongoing hack rather than activity connected to previously compromised wallets, is disputed and unconfirmed. No independently verified block-explorer transaction set proving wallet ownership attribution was included in the available evidence, and CoinDCX has not published a forensic postmortem or regulatory filing specific to the October 2026 movements.

CoinDCX’s Response and the Wallet Lifecycle Dispute

CoinDCX publicly described claims about the addresses and transactions as misleading, stating that the flagged activity relates to addresses created in early 2025 that were compromised during the July 2025 security incident and subsequently deprecated. The exchange said it had advised users not to deposit to the compromised wallet addresses.

In a follow-up statement, CoinDCX said the TQKJQ wallet activity is connected to those early-2025 addresses, reinforcing its position that the on-chain movements investigators are flagging are attributable to the prior, already-disclosed incident rather than a new breach. The exchange has not provided a date-ordered transaction reconciliation or publicly named the liquidity provider ZachXBT referenced.

The critical divergence is a matter of timing and fund flow. CoinDCX’s narrative places all relevant compromise in July 2025 and treats the deprecated addresses as a closed chapter. ZachXBT’s on-chain reading places active fund movements, gas transfers, and hot-wallet interactions as recently as May 2026, which, if accurate, would mean the exchange’s public disclosures did not cover the full scope of the wallet’s operational lifecycle. This is the specific factual dispute that neither side has resolved with verifiable public documentation.

Coinbase’s recent CCI approval for a CoinDCX stake acquisition gives the incident additional weight, as institutional partners will be scrutinizing CoinDCX’s security posture and disclosure standards as part of ongoing due diligence.

Why the Disclosure Gap Matters for CoinDCX Users

For users who held USDT or other assets on CoinDCX in 2025 and 2026, the dispute raises concrete custody and accounting questions that the exchange has not addressed with transaction-level specificity. CoinDCX’s “do not deposit” advisory, cited in its own statement, implies the exchange knew specific wallet addresses were compromised, but the public record does not show whether users who had funds in those addresses were individually notified or made whole.

Disclosure and custody questions still open

Exchange security incident disclosures typically require publication of affected wallet addresses, approximate fund exposure, and a timeline of the breach and response. If the TQKJQ address continued routing user deposits to CoinDCX’s hot wallet in April and May 2026, as ZachXBT’s on-chain reading suggests, users depositing during that window may have sent funds to a wallet the exchange internally classified as compromised. Whether those users were protected by internal routing controls or exposed to additional risk is not stated in any publicly available CoinDCX communication.

The broader market context adds pressure to the transparency question. The Fear and Greed Index sits at 68, in Greed territory, meaning exchange users are currently more risk-tolerant, not less. In a sentiment environment leaning toward trust and participation rather than caution, disclosure failures by centralized exchanges carry outsized reputational risk when they surface, because users have less guard up at the moment the information arrives.

What Evidence Would Settle the $16M CoinDCX Hack Dispute

The on-chain record is immutable and publicly accessible on TRON’s ledger. A complete resolution of this dispute would require several data points that neither investigators nor the exchange have published in full: the specific TQKJQ wallet address in a verifiable TRON explorer entry showing the full transaction history with timestamps, counterparty addresses, and USDT amounts; the identity and contractual relationship of the liquidity provider ZachXBT referenced; and a CoinDCX statement that either confirms or specifically refutes the April and May 2026 hot-wallet transfers ZachXBT cited.

Unanswered questions to monitor

The most material open question is whether CoinDCX’s current hot wallet received funds from the TQKJQ address after July 2025. If on-chain data confirms those transfers, CoinDCX’s narrative that the addresses were deprecated after the July 2025 incident would be factually incomplete. A second open question is whether India’s financial regulators have received any incident report for the July 2025 breach or the October 2026 movements, as no regulatory filing or enforcement action was found in the available evidence.

Understanding how centralized exchanges handle hot-wallet custody and incident disclosure is also relevant context for evaluating this dispute. Readers assessing their own exchange risk exposure may find how CeFi aggregators compare to DEX protocols in terms of custody model a useful frame, since non-custodial alternatives eliminate this class of exchange-side disclosure risk entirely.

The available evidence does not establish the allegation that CoinDCX lied or that a new hack occurred. It does establish a specific, unresolved discrepancy between CoinDCX’s stated wallet deprecation timeline and ZachXBT’s documented on-chain activity in April and May 2026. Until CoinDCX provides a transaction-level reconciliation or a third-party auditor publishes a forensic report, users and counterparties are evaluating custody and disclosure risk without the complete picture.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.