Indian crypto exchange CoinDCX says it has absorbed “operational losses” after a process meant to sweep deposits out of wallet addresses compromised in its July 2025 hack stopped working. In a post on X at 12:47 BST on Thursday, the exchange said some users had kept sending crypto to those old addresses despite warnings, and that the sweeping “failed” for “a particular period”, which it identified on Thursday morning. It did not say how much was lost.
The admission came about three and a half hours after CoinDCX had called claims about the same addresses “misleading”. Blockchain investigators put the outflow at about $16m. CoinDCX says every affected user deposit has been credited and that its current wallets were not touched.
How the transfers came to light
The first alarm came from Darcy, co-founder of asset recovery platform FlashRescue, according to Cointelegraph. In a post on X written in Chinese, he said that at 16:35 BST on Wednesday CoinDCX’s hot wallet and several of its deposit addresses sent about 15.99 million USDT and 5,783.81 TRX to a single address on the Tron network, with the largest transfer worth 15,819,002 USDT. He said the funds were then split and sent on to deposit addresses at exchanges including Binance, OKX and Gate. Those figures are Darcy’s; CoinDCX has not confirmed them.
CoinDCX’s first response, posted at 09:14 BST, said the transactions involved old addresses “created in January 2025”, which were “compromised in July 2025 and have not been used by CoinDCX since”, and that the activity “does not have any connection with CoinDCX”. Chief executive Sumit Gupta went further: “this is incorrect and CoinDCX wallets are not breached,” he wrote, adding that “the hackers seem to be re-using the old wallet addresses and this sounds like a false alarm”.
An investigator said one address was still in use
Blockchain investigator ZachXBT challenged that account within the hour. In a reply to CoinDCX, he said a deposit address beginning TQKJQ “was in use by a LP for 10 months after your July 2025 incident” and was sweeping user deposits to the exchange’s current public hot wallet as recently as April and May 2026. “Meaning $15.8M in user deposits was unaccounted for by your team,” he wrote. Gupta replied: “Yes, aware of that. we’re investigating it further, and will share an update soon. We assure that no user funds will be at loss.”
CoinDCX’s later statement changed the explanation. It said the addresses had been “deprecated” after the hack, that its “operational process is designed for regular sweeping” of any deposits still sent to them, and that “this failure led to some operational losses, which were absorbed by CoinDCX”. It added that “Customer assets continue to be held in segregated cold wallets” and that “no CoinDCX funds from active wallets have been compromised”.
CoinDCX lost $44m in the July 2025 hack, Cointelegraph says, and said at the time that it would cover the loss from its treasury reserves. Cointelegraph said CoinDCX had not responded to its own questions when it last updated its story.
The company’s account shifted within hours
What matters most here is not the size of the outflow but how CoinDCX described it. At 09:14 BST the exchange said the old addresses had no connection with it and had not been used since July 2025. By 12:47 BST it was saying it had been running a process to sweep deposits from those same addresses, and that the process had failed and cost it money. Both statements can be read as consistent only if “not used” meant that CoinDCX no longer issued those addresses to customers. The exchange has not said that, and its own update confirms that deposits kept arriving and that it treated them as customer money.
That leaves the key numbers open. CoinDCX has given no figure for its loss and no dates for when sweeping stopped, so the about $16m flagged by Darcy and the $15.8m cited by ZachXBT remain outside estimates. Nor has it said whether the address that received the funds belongs to the attackers from July 2025.
The statement also carries a warning to customers. CoinDCX said depositing to deprecated addresses is “highly risky” and that exchanges typically take no liability for such deposits, while saying it had credited these ones anyway. Users who still have the old addresses saved are being told to check the app or website for current ones. The episode adds an unusual entry to a busy year: Hacken says crypto hacks cost $1.18bn in the third quarter alone, and here the outflow Darcy flagged came more than a year after the original breach.
TSN tracks incidents like this on its crypto hacks and exploits hub, along with recent cases such as the Drift exploiter’s moves into Tornado Cash.
CoinDCX’s next update needs to give the figure its chief executive has not: how much it lost.
Sources
- CoinDCX on X: Further update on the TQKJQ wallet on-chain activity, 22 October 2026
- CoinDCX on X: Users’ funds are safe, 22 October 2026
- Sumit Gupta on X, 22 October 2026
- Sumit Gupta on X, reply to ZachXBT, 22 October 2026
- ZachXBT on X, 22 October 2026
- Darcy on X, 22 October 2026
- Cointelegraph: CoinDCX admits ‘operational losses’ after $16M wallet transfers draw scrutiny, 22 October 2026
Related stories
- Railway Says Attacker May Have Decrypted Some Customer Environment Variables
- Drift Exploiter Moves About $61m of Ether Into Tornado Cash, Cointelegraph Says
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
