CoinDCX is back under the microscope. Over October 21-22, 2026, on-chain analysts spotted approximately $15.99 million in USDT, plus 5,784 TRX, moving out of wallets tied to India’s largest crypto exchange.
What the blockchain showed
Arkham Intelligence was first to raise the alarm. Its data showed funds leaving addresses labeled as CoinDCX deposit and hot wallets on the Tron network.
After leaving those addresses, the money was split up and scattered across several centralized exchanges, including Binance, OKX, and Gate.io.
CoinDCX’s explanation
Co-founder Sumit Gupta moved quickly to deny any breach or user impact. According to Gupta, the wallets were created in January 2025 and were then compromised during a July 2025 incident in which CoinDCX lost $44 million from an internal liquidity wallet.
Gupta said those addresses had not been used since that hack and that the exchange’s current operational addresses showed no linked outflows.
Gupta also told users their funds remain secure and that trading and other services were running without interruption.
ZachXBT pushes back
Blockchain investigator ZachXBT was not convinced. He pointed to at least one flagged address that kept receiving user deposits and gas fees until April-May 2026.
That timeline matters. It would mean the address stayed active for roughly 10 months after the July 2025 incident that supposedly retired it.
If ZachXBT’s reading holds, users may have kept sending deposits to an address the exchange considered compromised, raising a pointed question about whether any of those deposits went unaccounted for.
A familiar backdrop
The July 2025 hack cost the exchange $44 million, a loss it absorbed from an internal wallet rather than from customer balances.
What this means for users and the market
The clearest way to settle the dispute would be a transparent accounting — explaining why a supposedly retired address kept receiving deposits and gas through April-May 2026, and confirming what happened to those deposits.
The involvement of Binance, OKX, and Gate.io as landing spots for the fragmented funds is another thread to watch. Centralized exchanges can freeze assets when they are flagged quickly enough, so how those platforms respond may shape whether any of the money is traceable or recoverable.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.