Security
CoinDCX Says a Failed Sweep Job Cost It $16 Million. ZachXBT Says the ‘Retired’ Address Was Live for 10 Months
India's largest exchange spent a day moving from “misleading” and “no connection with CoinDCX” to “operational losses, which were absorbed.” It says no current wallet was touched. An on-chain investigator says the old address was still doing the exchange's work.
Around October 21, an X user who goes by Darcy, a co-founder of the asset-recovery firm FlashRescue, pointed at roughly $16 million moving out of addresses labeled as CoinDCX's. By Thursday, October 22, the exchange had given two different accounts of it. The first said the money had nothing to do with CoinDCX. The second said a routine process had failed, users had lost deposits, and the exchange had paid them back.
The exchange is India's largest by CoinDesk's description, and it was hacked in July 2025 for about $44 million. That history is the whole context. The question now is whether this is that attack's leftover, or something new.
What was moved
CoinDesk reports that Darcy flagged an outflow from CoinDCX's hot wallet and several deposit addresses, about $16 million in USDT and TRX, all sent to one Tron address, the largest single transfer being 15,819,002 USDT. CoinGeek puts the other leg at about 5,800 TRX and says the funds were then split toward Binance, OKX and addresses linked to Huione Group. This desk has not independently traced the transfers, and none of the three outlets prints the addresses involved. The day is also not settled: CoinDesk and CoinGeek say Wednesday, while Cointelegraph says Darcy flagged it on Thursday.
DefiLlama's incident feed lists the event under the technique “Hot Wallet Key Compromised” with a $16 million figure. That label is DefiLlama's. CoinDCX has not said a key was compromised, and says the opposite about its current wallets.
Two statements, one day apart
The first reply, quoted by CoinGeek, called the claims “misleading.” CoinDCX said the activity involved old addresses from the July 2025 attack and had “does not have any connection with CoinDCX.” A spokesperson told CoinDesk the addresses were created in January 2025, compromised in July 2025 and not used since, and that “current CoinDCX central and user addresses have not been impacted.” CEO Sumit Gupta wrote on X that the July 2025 attackers appeared to be reusing the old addresses and called the reports a false alarm, per CoinDesk.
Then came the second account, posted Thursday. Some users, CoinDCX said, kept depositing to the compromised addresses after being told not to. The exchange normally sweeps deposits out of old addresses, and that process “failed for a period.” In its words, quoted by Cointelegraph, “This failure led to some operational losses, which were absorbed by CoinDCX.” All affected deposits, it said, have been credited to users. Customer assets, it said, remain in segregated cold wallets.
What CoinDCX said about the old addresses, in order
| When | Position |
|---|---|
| Oct 21 | Claims “misleading”; old addresses, compromised in July 2025, not used since |
| Oct 21 | Gupta: “aware of that,” investigating; no user funds will be lost |
| Oct 22 | Sweep process “failed for a period”; losses absorbed; affected users credited |
The two accounts are not strictly contradictory. The second can be read as an explanation of the first: money users had deposited to retired addresses was taken by whoever held those addresses' keys. But a company that says an event has “no connection” to it, and a day later says users lost money on it, has told its customers two different things, and the order matters.
The ten-month claim
The sharper challenge came from ZachXBT. On X, quoted by CoinDesk, he said at least one address, labeled TQKJQ, was still in use: a liquidity provider used it for 10 months after the July 2025 incident, it swept user deposits and received gas as recently as April and May 2026, and it forwarded funds to CoinDCX's current public hot wallet. CoinGeek reports him putting $15.8 million of user deposits as unaccounted for.
If that is right, the address was not abandoned, and “not used since July 2025” does not describe it. CoinDesk notes that its article does not resolve the conflict, and neither does anything this desk read. Gupta's answer, per Cointelegraph, was that the company was aware, was investigating and would share an update. This desk found no published reply from CoinDCX to the specific ten-month claim.
What nobody has said
No source this desk read says how many users deposited to the old addresses, or how much of the roughly $16 million was theirs. None names the liquidity provider. None says how long the sweep process was down, how it came to be sweeping from addresses whose keys had been compromised, or why deposits to those addresses were still being credited. CoinDCX has not published the addresses, and the one outlet that prints a label for one (CoinDesk) prints only the first letters. The headline numbers also vary by outlet: CoinDesk and CoinGeek say about $16 million, and CoinDesk's headline attributes the outflow to a broken clean-up job while its body stops short of tying the whole figure to it.
What is consistent across all three: the exchange says its current wallets were unaffected, says affected users were made whole, and does not describe a new breach.
The Take
A deprecated address with a compromised key is a standing trap, and it works only while something still sends money to it. Whether the sender was users ignoring a warning, a liquidity provider's routine, or a sweep job that kept pointing at the wrong place is the entire story, and CoinDCX has so far told it two ways. Making users whole is the right outcome. It is not the same as saying what happened, and the exchange's customers are owed the second thing as well as the first.