Tether freezes $2.2 million linked to CoinDCX outflow amid dispute over wallet breach
Tether froze $2.2 million in USDT connected to a $16 million outflow from Indian crypto exchange CoinDCX, coming after on-chain investigators contested the platform's explanation of compromised deposit addresses.
Stablecoin issuer Tether has frozen $2.2 million in USDT connected to a roughly $16 million outflow from Indian cryptocurrency exchange CoinDCX. The intervention followed alerts raised on October 22, 2026, by blockchain investigator Darcy of security firm Salus, who flagged suspicious transfers totaling about 15.99 million USDT and 5,783 TRX routed from CoinDCX deposit and hot wallet addresses to a TRON address.[3][4][7][9]
CoinDCX co-founder Sumit Gupta initially dismissed the findings as a false alarm, claiming the flagged wallets dated back to January 2025 and were compromised in a $44 million hack of the exchange in July 2025. CoinDCX later stated that while it warned users against depositing into deprecated addresses, some continued doing so. The exchange acknowledged that its routine deposit-sweeping process failed for a period, triggering operational losses that it absorbed while crediting affected customers' accounts. CoinDCX did not disclose the total financial loss.[5][8][9][1][2]
Prominent on-chain researchers quickly disputed the exchange's account. Analyst ZachXBT alleged that $15.8 million in user deposits remained unaccounted for, pointing out that an affected deposit address was active and sweeping funds into CoinDCX's current public hot wallet as recently as May 2026, and urged users to withdraw their assets. Other researchers, including Taylor Monahan and SpecterAnalyst, noted that transaction behavior and laundering methods diverged from the July 2025 incident. Gupta maintained that CoinDCX is examining the matter and assured that no user funds will be lost.[3][5][9][6]
Key facts
- Tether froze $2.2 million in USDT linked to an outflow of roughly $16 million from CoinDCX.
- Investigator Darcy of Salus flagged approximately 15.99 million USDT and 5,783.81 TRX moved from CoinDCX-associated addresses on October 21, 2026.
- CoinDCX stated that a deposit-sweeping process for deprecated addresses compromised in a July 2025 hack failed, leading to operational losses that the exchange absorbed while crediting affected users.
- CoinDCX did not disclose the specific amount of losses it absorbed.
- On-chain sleuth ZachXBT disputed CoinDCX's statements, alleging that $15.8 million in deposits was unaccounted for, that deprecated addresses were active as late as May 2026, and urged users to withdraw funds.
- CoinDCX co-founder Sumit Gupta pledged that no customer funds would be at a loss.
Sources · 9 sources
- CR
CryptoSlateArticle ·
Old wallet addresses trap CoinDCX users, triggering potential losses The exchange says a failed deposit-sweeping process caused losses it absorbed, while ZachXBT's $15.8 million allegation remains unreconciled. Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - CR
CryptoSlate@CryptoSlatePost on X ·
CoinDCX says it absorbed losses from failed sweeping of deposits sent to old wallet addresses and credited affected customers. @zachxbt alleges $15.8M in user deposits was unaccounted for; the exchange gave no loss amount. via @akibablade https://t.co/4nl9k740Mj
Open source - CO
CoinDesk@CoinDeskPost on X ·
UPDATE: @Tether freezes $2.2M in $USDT linked to the $16M @CoinDCX outflow as onchain investigator @ZachXBT disputes the exchange’s account, alleging compromised deposit addresses were still active as recently as May 2026 and urging users to withdraw funds. https://t.co/Y911u9eRrK
Open source - CN
crypto.news@cryptodotnewsPost on X ·
JUST IN: Tether freezes $2.2M USDT linked to the $16M drained from CoinDCX This follows ZachXBT's questioning of CoinDCX’s explanation, claiming suspicious deposit addresses were still active in May 2026. https://t.co/HXWxEwzNHS
Open source - UN
UnchainedArticle ·
CoinDCX Absorbs Losses, Credits Users After Failed Sweep of Hacked Deposit Addresses Customers of CoinDCX who kept sending crypto to wallet addresses the exchange deprecated after its July 2025 hack have had their accounts credited, the India-based exchange said on Thursday, Oct. 22, adding that it is covering the resulting losses itself. After hackers drained about $44 million from an internal CoinDCX account in July 2025, CoinDCX says it warned users to stop depositing to the addresses compromised in that breach. Funds that still landed there, it said, were meant to be swept routinely so the exchange could secure them. In the post, CoinDCX said that sweep “failed” for “a particular period,” a problem it said it identified Thursday morning India time. The breakdown “led to some operational losses, which were absorbed by CoinDCX,” the post said. The exchange did not say how long the sweep was down or how many users were affected. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . A Day of Conflicting Posts Tron blockchain records show the TQKJQ address moved 15,819,002 USDT at 11:35 a.m. ET on Wednesday, Oct. 21, to a wallet created about three hours earlier. That wallet had passed on all of the USDT it received by 11:22 p.m. ET that night. Who controls it is not known. CoinDCX headed its Thursday post as a “further update on the TQKJQ wallet On-Chain activity,” but did not put a figure on its losses or say whether that transfer was part of them. Early Thursday, CoinDCX co-founder Sumit Gupta denied a new breach, saying the flagged addresses dated to January 2025 and fell to hackers that July. “The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm,” he wrote. CoinDCX said in its own X post that the addresses “have not been used by CoinDCX since” the hack. On-chain investigator ZachXBT then alleged that in April and May 2026 TQKJQ was still sweeping user deposits into the hot wallet CoinDCX currently uses, writing that “$15.8M in user deposits was unaccounted for by your team.” CoinDCX has not confirmed that figure. Gupta replied that the team was looking into it, adding, “We assure that no user funds will be at loss.” Chain data show TQKJQ’s first activity on March 27, 2025, and incoming USDT transfers continuing until May 4, 2026. The exchange said customer assets sit in segregated cold wallets and that the central and user addresses it now uses were untouched. What Users Should Do CoinDCX told users not to deposit to deprecated addresses and to “always verify updated deposit addresses from the CoinDCX App or website.” It also cautioned that “exchanges do not typically take liability for such deposits made.” It has not said whether it will keep crediting deposits sent to those addresses. Related Listen: How Did Hackers Take $388M From Bitget Without a User Withdrawal? The post CoinDCX Absorbs Losses, Credits Users After Failed Sweep of Hacked Deposit Addresses appeared first on Unchained .
Open source - CB
Crypto BriefingArticle ·
CoinDCX pledges no user losses after $16M transfer scrutiny CoinDCX's pledge highlights the need for transparency and robust security measures to maintain trust in the volatile crypto market. The post CoinDCX pledges no user losses after $16M transfer scrutiny appeared first on Crypto Briefing .
Open source - TD
The Daily Block@thedailyblockPost on X ·
🚨 BREAKING: Tether Freezes $2.2M in USDT Linked to CoinDCX Hack The freeze comes after $16M was drained from CoinDCX. ZachXBT also questioned the exchange’s explanation, saying suspicious deposit addresses were still active in May 2026.
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨JUST IN: @CoinDCX denies links to reported transfers of 15.99 million USDT, saying the wallets involved were compromised in July 2025. https://t.co/05avRWU3Yz
Open source - PR
ProtosArticle ·
Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators On Thursday morning, blockchain investigator “Darcy” flagged suspicious movements totalling $16 million on addresses suspected to be associated with crypto exchange CoinDCX. Shortly afterwards, CoinDCX co-founder Sumit Gupta thanked the researcher, who works for security firm Salus, but insisted that the attribution was “incorrect,” urging Darcy “don’t spread rumours.” A number of on-chain sleuths have since taken issue with CoinDCX’s statements, with “SpecterAnalyst” flatly accusing the firm and its co-founder of “lying.” 10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX 其中最大单笔为 15,819,002… — Darcy 资产救援 (@DarcyAri) October 22, 2026 Read more: CoinDCX hack: $44M gone after dev opens file from side gig CoinDCX calls claims “misleading” A later update from the exchange’s official X handle then stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.” CoinDCX was hacked for $44 million last year after a software engineer’s company laptop was compromised while being used for work on side gigs. Contradicting its initial statement, a second post clarified that CoinDCX users continued to deposit funds into the compromised address, despite the exchange warning against doing so. In response, it carried out “regular sweeping… so the funds can be properly accounted for and secured.” Further update on the TQKJQ wallet On-Chain activity. Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been… — CoinDCX (@CoinDCX) October 22, 2026 Read more: Ledger spyware scare spreads beyond Southeast Asia However, “for a particular period, this sweeping process failed,” and apparently only came to light after Darcy’s post, flagging the withdrawal of the funds. CoinDCX eventually recognised the funds as “some operational losses,” and insists the deposits were credited to user accounts. It doesn’t go into detail on how the $16 million went unaccounted for over such a long period. Protos has reached out to CoinDCX via email, but hadn’t received a response by the time of publication. Read more: Bitget’s eighth birthday ends with a $352M hack Blockchain sleuths have their doubts Responding to Gupta’s initial denial, Darcy took issue with the claim that the wallets were not used by CoinDCX, pointing to gas distribution activities both before and after the July 2025 hack. They also noted that some funds were sent to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” adding “please don’t dodge the issue.” Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques differ between today’s transfers and last year’s hack, implying different actors. Well known blockchain sleuth ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” post-compromise, and sent funds to “your current public hot wallet” as recently as May 2026. Other pseudonymous investigators weighed in, with Tanuki42 highlighting the exchange’s contradictory communications and SomaXBT accusing CoinDCX of having moved $70 million of a market maker’s funds via the supposedly deprecated address. For those who don't know how to identify stolen funds, it's often pretty easy. One way to identify a potentially compromised wallet is to look for a sudden change in its established transaction patterns. For instance, TQKJQ, a CoinDCX deposit address, had consistently been… pic.twitter.com/215kRk3jbT — Specter (@SpecterAnalyst) October 22, 2026 Read more: Phishing scammers capitalise on Ledger panic with fake firmware update SpecterAnalyst’s aforementioned post describes the typical signals that indicate outflows of stolen funds. It notes the change in behaviour from the affected address, which previously sent funds to CoinDCX’s hot wallet, to suddenly sweeping funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.” Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators appeared first on Protos .
Open source