Crypto detective warns users to ‘withdraw all funds from CoinDCX’

ZachXBT, a well-known blockchain investigator, has urged users to ‘withdraw all funds’ from the CoinDCX exchange, accusing the platform’s founders of lack of transparency involving a $16 million case.

In a post on X, he argued that founders Sumit Gupta and Neeraj Khandelwal initially denied a reported $16 million loss before later acknowledging an operational issue involving an old wallet.

He further described the executives as ‘clowns running a circus’ and reminded his followers that the incident was not the first one on CoinDCX’s track record.   

“Withdraw all funds from CoinDCX if you value your assets. Its co-founders are clowns running a circus,” ZachXBT wrote.

Withdraw all funds from CoinDCX if you value your assets.

Its co-founders are clowns running a circus.

They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent.

Later they disclosed the $16M theft and… pic.twitter.com/uEmtogPonq

— ZachXBT (@zachxbt) October 22, 2026

ZachXBT slams CoinDCX over $16 million in stolen crypto

The controversy began on October 21, when approximately $15.99 million in Tether (USDT) was tracked moving from a wallet associated with CoinDCX and being transferred to deposit addresses linked to other exchanges, including Binance.

Gupta initially dismissed the reports as mere rumors, claiming the relevant addresses were old, compromised during the exchange’s July 2025 security incident. However, ZachXBT argued that the wallet, identified by an address beginning with ‘TQKJQ,’ remained active for approximately 10 months after that. 

Based on the investigation, the address continued receiving user deposits and forwarding funds to CoinDCX’s current public hot wallet as recently as May 2026. During this time, ZachXBT said, roughly $15.8 million in user deposits was properly accounted for.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team,” he added.

CoinDCX denies allegations

Gupat himself stressed that the wallet had indeed been compromised in July 2025, but that hackers continued to use it afterwards, which led to a false alarm. ZachXBT’s criticism, however, continued to center on the initial denial of the incident, both publicly and privately.

The investigator argued that the discrepancy suggested either deliberate dishonesty or serious incompetence. Moreover, he also compared CoinDCX with WazirX and BitBNS, two other Indian cryptocurrency exchanges that have faced security-related controversies.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team. Why are Indian CEXs so untrustworthy?” he added.  

CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.

Meaning $15.8M in user deposits was unaccounted for by your team.

Why are Indian… pic.twitter.com/S8WYtGNIjz

— ZachXBT (@zachxbt) October 22, 2026

Whatever the case may be, the incident has raised some serious questions about CoinDCX’s internal controls and transparency. While the sum involved is by no means negligible, however, it still remains to be seen whether ZachXBT’s words are going to have any influence on how the exchange operates and how traders view its storage capabilities.

Featured image via Shutterstock