In this article4 sections
On-chain investigator Darcy flagged about $16 million in suspicious transfers from addresses previously tied to Indian exchange CoinDCX to a single TRON wallet on Oct. 21, 2026, Ambcrypto reported. The movement included roughly 15.99 million USDT and 5,784 TRX, with the largest single transaction at 15.82 million USDT before the funds were split and routed to deposit addresses linked to Binance, OKX and Gate.
CoinDCX rejected the suggestion that its current wallets were hit, and its chief executive said customers would not lose money, Cointelegraph reported.
Also read: Stolen Bitget, Ledger and Triple-A funds traced into Zcash pools
Key facts
- About $16 million moved from CoinDCX-linked addresses: 15.99 million USDT and 5,784 TRX sent to one TRON wallet on Oct. 21, 2026.
- CoinDCX CEO Sumit Gupta said the wallets were created in January 2025, were compromised in July 2025 and had not been used by the exchange since.
- Blockchain investigator ZachXBT said one CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July 2025 incident and still routed user deposits to the exchange’s current public hot wallet, per Cointelegraph.
- Darcy, co-founder of asset recovery platform FlashRescue, also claimed two addresses listed in CoinDCX’s latest proof of reserves sent funds to the flagged TRON address, Cointelegraph reported.
- CoinDCX was drained for $44 million in July 2025; it said then that customer wallets were separate from the affected account and that it would cover the loss from treasury reserves.
Founders push back as investigators publish evidence
Gupta called the breach claims incorrect and asked onlookers not to spread rumours, saying the exchange had checked all of its present central and user addresses and found none that sent money to the old addresses.
In an updated statement, he said the flagged wallets, including one identified as TQKJQ, had been deprecated after the July 2025 exploit. The exchange said it absorbed the operational losses and credited all affected users, and that customer assets stayed in segregated cold storage.
Also read: Conduit Sues Tether Over $2.76M USDT Frozen Since 2025
ZachXBT disputed that version, saying on-chain records showed the address was still active with a liquidity provider, regularly processed user deposits and interacted with a current CoinDCX hot wallet as recently as April and May 2026. The investigator told users to withdraw funds and criticised the exchange’s co-founders in blunt terms.
The accounts differ on how dormant the wallets really were. Ambcrypto’s report centres on the transfers and Gupta’s denials; Cointelegraph adds that Gupta responded to the ZachXBT findings by saying the exchange was investigating further, would share an update soon, and that no user funds would be at a loss. Cointelegraph also reported that CoinDCX did not answer its inquiry before publication. Ambcrypto noted the issue raised questions over whether roughly $15.8 million in assets had actually gone missing.
Why it matters
India’s largest exchanges are the front door for retail crypto buyers, so any doubt over CoinDCX’s wallet hygiene reaches a large user base directly. The dispute also tests whether proof of reserves and post-hack public statements hold up when on-chain data is audited independently, and it lands less than two years after the $44 million July 2025 hack.
Separately, the same week, Indian exchange SunCrypto reported server-side technical issues that took its app offline temporarily; SunCrypto said it was restoring services and that user funds were safe, Ambcrypto reported.
What to watch
CoinDCX said it would share an update after investigating the ZachXBT findings, so that statement is the next concrete marker. How the exchange reconciles its proof-of-reserves addresses with the flagged TRON wallet will determine whether this stays a dispute over old wallets or becomes a fresh loss claim.
Reported by ambcrypto.com.
Sources: AMBCrypto, Cointelegraph