The short version
- CoinDCX hack: India’s largest crypto exchange confirmed on Sunday that an attacker took 15.99 million USDT from 40 old deposit addresses on TRON, three days after its co-founder said its wallets were “not breached.”
- A failed deposit sweep left customer deposits sitting at addresses CoinDCX had stopped using; the exchange says it covers the loss and user funds in its cold wallets are safe.
- The crew is watching the $2.2 million Tether froze in nine wallets and whether CoinDCX shows more on how the other $13.8 million got away.
The CoinDCX hack went from “not breached” to a $16 million loss in three days. On Thursday, the co-founder of India’s largest crypto exchange told X that “CoinDCX wallets are not breached.” On Sunday, the exchange’s own update put the damage at 15.99 million USDT, and said it would cover it.
Tether has frozen $2.2 million of the stolen money so far. The rest moved through fresh wallets within hours. So what actually broke, why did CoinDCX deny it first, and what does it mean if you trade there?
This was the first answer, two hours after the alarm went up on X:
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the
What Happened in the CoinDCX Hack?
An attacker emptied 40 old CoinDCX-linked addresses on the TRON network. The chain shows the whole move: from 14:33 Copenhagen time on Wednesday, October 21, USDT left the addresses one by one for a single fresh wallet.
The big one came at 17:35. An address starting TQKJQ sent 15,819,002 USDT in one transfer. The other 39 added about $172,000 between them, from a few cents to $35,000 each. In total, 15,991,410 USDT, a stablecoin worth a dollar each, plus 5,783.81 TRX.
On-chain analyst Darcy flagged it on X at 07:30 the next morning. By then the wallet was empty. It had sent everything on to six new addresses in under 12 hours, in chunks of $10 to $3 million.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Did CoinDCX Deny the Hack First?
Because, by its first account, the money wasn’t CoinDCX’s anymore. Co-founder Sumit Gupta wrote at 10:10 on October 22 that the addresses “used to belong to CoinDCX before the last year hack ie July 2025,” and asked people not to spread rumours. Four minutes later the exchange posted “Users’ funds are safe” and called the claims “misleading.”
That story lasted about 40 minutes. On-chain investigator ZachXBT replied that the TQKJQ address “was in use by a LP for 10 months after your July 2025 incident.” It was still sweeping user deposits to CoinDCX’s current public hot wallet, and getting gas for it, as late as April and May 2026. In other words, by his count, $15.8 million in user deposits sat in a wallet the exchange said it had left behind.
On Sunday at 05:36, CoinDCX published its full update. Its automated sweep, the job that moves new deposits out of deposit addresses into the main wallets, had stopped working for a while. Deposits piled up at old addresses with what it called an unknown vulnerability, and the attacker took them. “This led to a loss of 15.99 million USDT which was absorbed by the company,” the exchange said, adding that it “could have been more proactive.”
How Much of the $16M Has Tether Frozen?
About 14%. Tether blacklisted nine wallets in the attacker’s trail at 00:45 on October 23, about 31 hours after the theft. Together they hold 2,212,850 USDT that can no longer move.
We checked the freeze on-chain: four of the nine sit directly on the path from the attacker’s wallet, one to three hops out. That’s the reach of a Tether freeze. The company can lock USDT in any address, something nobody can do to Bitcoin or TRX.
The other $13.8 million is still out there. It has been split across dozens of wallets, and CoinDCX’s update doesn’t mention any recovery. ZachXBT’s advice to users, posted the same afternoon: “Withdraw all funds from CoinDCX if you value your assets.”
Are CoinDCX Users’ Funds Safe?
CoinDCX says yes. Customer money sits in separate cold wallets, trading, deposits and withdrawals kept running, and users whose deposits were taken have been credited. The company pays the $16 million itself.
It’s CoinDCX’s second exchange hack in 15 months. In July 2025, hackers took about $44 million from an internal CoinDCX account used to supply liquidity on a partner exchange, and the company absorbed that one too. Two losses of that size are a lot to swallow, even for an exchange with millions of users.
The worry is less the money than the denial. An exchange that calls a real theft a rumour is asking users to take its next statement on faith.
DISCOVER: Your First Crypto Wallet, Set Up Safely: Hot vs Cold and the Seed Phrase
What Should You Do If You Use an Exchange?
Copy the deposit address fresh from the app every single time. This loss started because users kept sending USDT to addresses CoinDCX had stopped using, and the exchange’s cleanup job missed them. A saved address from last year is exactly how a deposit ends up somewhere nobody is watching.
EXPLORE: How to Send Crypto Without Losing It: Networks, Addresses and Test Transactions
Keep only trading money on any exchange, and move the rest to a wallet you control. If the exchange publishes proof of reserves, check it now and then.
The CoinDCX hack is now a known loss with a known payer. What happens to the frozen $2.2 million, and whether CoinDCX shows an outside review of how a wallet it called retired kept taking deposits, will decide how many users stay.
In crypto since 2016. Covers altcoins and the daily market. When not trading, out climbing and traveling.
More from Teddy →
