Blockchain investigators are disputing CoinDCX's explanation for approximately $16 million in suspicious movements from wallet addresses linked to the Indian crypto exchange, alleging the exc
Blockchain investigators are disputing CoinDCX's explanation for approximately $16 million in suspicious movements from wallet addresses linked to the Indian crypto exchange, alleging the exchange's public account of events does not match on-chain data. CoinDCX, which suffered a separate $44.3 million hack in July 2025 per Halborn's security analysis, says the flagged addresses were already compromised and deprecated before the latest movements occurred.
On October 22, 2026, blockchain investigator Darcy flagged suspicious on-chain movements totalling approximately $16 million from addresses suspected to be associated with CoinDCX, reporting roughly 15.99 million USDT and 5,783.81 TRX in the flagged flows. The assets moved on the TRON network, with the TQKJQ deposit address identified as the focal point of investigator scrutiny. For related coverage, see Blockchain Trading Account Adds Options Trading: What to Know.
Investigator-reported suspicious movements $16 million Amount reported by investigators; CoinDCX says the affected addresses were already compromised and deprecated.Three key claims frame the dispute. First, investigators assert the addresses remained operationally active long after the July 2025 incident CoinDCX cited as the point of compromise. Second, CoinDCX says the wallets in question were created in January 2025, compromised in July 2025, and formally deprecated following that security event. Third, the exchange states that user deposit balances were fully credited and that neither active central wallets nor live user addresses were affected. For related coverage, see Best Crypto Casinos for Halloween 2026: Live Events, Spooky Slots, and Real Bonuses.
The $16 million figure is an investigator-reported amount, not a number CoinDCX has independently confirmed as a discrete loss total. The exchange's public statement characterizes any shortfall as an operational loss it absorbed internally, not a fresh external hack. For related coverage, see Lighter Review 2026: What the Trading Experience Actually Feels Like.
ZachXBT, the pseudonymous blockchain investigator, alleged that the TQKJQ deposit address remained in active use by a liquidity provider for 10 months after the July 2025 incident, placing $15.8 million in user deposits as unaccounted for in CoinDCX's public reconciliation. That allegation is an investigator claim, not a finding confirmed by CoinDCX or an independent forensic audit.
The core analytical discrepancy centers on the timeline: if a wallet was deprecated in July 2025, continued deposits and outflows through late 2026 would indicate either the deprecation was incomplete, the address was re-used, or a third party retained access. CoinDCX's statement acknowledges that deposits continued reaching deprecated addresses and that its regular sweeping process for those post-deprecation deposits failed for a period, resulting in operational losses the exchange absorbed.
On-chain evidence on TRON is publicly verifiable, but attributing wallet control to a specific exchange requires more than address association. No block-explorer transaction hash list or independent forensic report reconciling the TQKJQ wallet's full transaction history was included in CoinDCX's public statement, leaving the specific $16 million attribution unresolved at the wallet level.
The July 2025 incident that preceded this dispute was itself significant. Halborn's security analysis placed that hack at $44.3 million, describing a server and private-key compromise that drained a hot wallet before assets moved to Solana addresses and were subsequently bridged to Ethereum. That prior incident gives context for why the TQKJQ addresses were flagged as compromised in the first place, but it does not independently resolve whether those addresses were fully decommissioned afterward. Notably, Coinbase holds a pending investment stake in CoinDCX, a relationship that adds regulatory and reputational dimensions to the exchange's handling of successive security incidents.
CoinDCX's official position, posted publicly on X, rests on four assertions: the flagged addresses were compromised in July 2025 and deprecated; deposits continued to arrive at those deprecated addresses after the fact; the sweep process that would have recovered those later deposits failed temporarily; and the resulting operational losses were absorbed by CoinDCX, with affected user deposit wallets credited in full.
The exchange explicitly stated that active central and user addresses were not impacted, framing the incident as an internal operational gap rather than a new external breach. CoinDCX did not publish the dollar value of operational losses it absorbed, nor a transaction-level reconciliation for the TQKJQ wallet, which is the central gap investigators are highlighting.
Broader market context at the time of the dispute shows Bitcoin trading at $81,424, down 3.6% in 24 hours, with the Fear & Greed Index at 68, indicating a Greed-dominant sentiment environment. Exchange security incidents historically trigger deposit outflows at affected platforms regardless of sentiment conditions, making CoinDCX's transparent reconciliation more consequential than under neutral market conditions.
The unresolved factual questions are specific. CoinDCX has not published the transaction hashes for the TQKJQ wallet's post-deprecation activity, the exact date the sweeping process failed and was restored, or the total dollar value of deposits that arrived at deprecated addresses between July 2025 and the October 2026 flagging. Until wallet-level reconciliation is published, the gap between the $15.8 million investigators cite and CoinDCX's unquantified "operational losses" figure remains open. Investors monitoring broader exchange infrastructure developments, including regulatory approvals affecting competing platforms, will be watching whether CoinDCX provides a detailed post-mortem or allows the dispute to persist without on-chain corroboration.
No regulatory filing, enforcement action, or law-enforcement disclosure tied to the October 2026 wallet-loss disclosure has been confirmed. Per the research record, the visible response to the incident is concentrated among blockchain investigators rather than regulators. According to unconfirmed investigator reports, the characterization that CoinDCX deliberately misrepresented the address usage remains a disputed allegation; the exchange's own account offers a different operational explanation that has not yet been refuted with a published transaction-level audit.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on marketbit.net