India's largest cryptocurrency exchange, CoinDCX, has denied being hacked after blockchain investigators flagged approximately $16 million in suspicious outflows of USDT and TRX from addresse
India's largest cryptocurrency exchange, CoinDCX, has denied being hacked after blockchain investigators flagged approximately $16 million in suspicious outflows of USDT and TRX from addresses linked to the platform, reigniting scrutiny over the exchange's security posture more than a year after a confirmed $44 million breach.
On-chain sleuths, including prominent investigator ZachXBT, publicly flagged the transfers, pointing to wallet addresses associated with CoinDCX as the origin of the outflows. The largest individual transfer identified in the flagged activity was 15,819,002 USDT, a single movement large enough to draw immediate attention from the on-chain monitoring community.
Suspicious outflows flagged ~$16M Reported USDT and TRX outflows from CoinDCX-linked addressesZachXBT's analysis centered on a specific TRON deposit address labeled TQKJQ, which the investigator said was used by a liquidity provider for ten months following CoinDCX's acknowledged July 2025 incident. According to ZachXBT, the address continued to sweep user deposits and receive gas as recently as April and May 2026, well after CoinDCX claims it had been decommissioned. For related coverage, see AI Revolution Summit – India 2026.
The investigator framed roughly $15.8 million in user deposits as unaccounted for by CoinDCX's own team, characterizing the transaction trail as an operational-accounting problem rather than independently confirming a fresh active-wallet compromise. A separate researcher, Darcy, also flagged the outflows, though those claims remain unconfirmed and CoinDCX explicitly disputes them. For related coverage, see World Datacentre Summit India 2026 Opens Sponsorship, Speaking, and Exhibition Opportunities.
Largest reported transfer 15,819,002 USDT Largest transfer reported among the flagged outflowsThe distinction between deprecated and active wallets is central to the dispute. Investigators are alleging that addresses still linked to CoinDCX's operations moved funds under suspicious circumstances. CoinDCX says those addresses had no live role in its current infrastructure, a claim that ZachXBT's timeline of on-chain activity directly contests. For related coverage, see Chamath Palihapitiya Says Bitcoin Could Go to Zero After a Hack.
A CoinDCX spokesperson told CoinDesk that the questioned addresses were created in January 2025 and compromised in July 2025, the same month the exchange suffered a confirmed $44 million breach after an internal liquidity account with an unnamed partner exchange was accessed by attackers. The spokesperson said those addresses are no longer in use and that CoinDCX's current central and user-facing addresses were not impacted by the flagged activity.
CoinDCX attributed the operational loss to a temporary failure in its process for sweeping deposits sent to deprecated addresses. The exchange said affected users were fully credited and the exchange absorbed the resulting losses itself. No specific timeline for when the sweep failure occurred or how many users were affected was included in the public statement.
The unresolved tension in the exchange's response is significant. If the TQKJQ address was genuinely decommissioned after July 2025, ZachXBT's documented evidence of deposit sweeps and gas receipts through April and May 2026 would suggest either that the address remained operational far longer than acknowledged, or that a third party maintained access using the compromised credentials from the original breach. Neither scenario has been independently verified on-chain through a reconciled address history, and no block-explorer entry directly tying the flagged outflows to CoinDCX's current hot wallets has been published.
For users of regional exchanges across Southeast Asia, the incident underscores a vulnerability pattern that has surfaced repeatedly at large centralized platforms: legacy wallet infrastructure that remains partially active after a security incident. Exchanges such as those operating without robust KYC and sweep protocols face compounded exposure when deprecated addresses retain real balances or gas funding.
The immediate question for CoinDCX is whether it will publish an on-chain reconciliation that maps the flagged TQKJQ address against its own records, showing definitively when the address was last used for authorized exchange operations. Without that disclosure, the gap between the exchange's statement and ZachXBT's documented activity remains open.
Users will also be watching for a formal proof-of-reserves update or wallet clarification that accounts for the specific addresses named by investigators. CoinDCX has not announced any such publication as of this writing, nor has any regulatory body in India confirmed an inquiry into the October 2026 outflows.
The broader market context offers little immediate pressure to force a resolution quickly. Bitcoin is trading at $81,551 with a 24-hour change of approximately -0.2%, and the crypto Fear and Greed Index sits at 50, indicating a neutral market mood that has not been materially disturbed by the CoinDCX allegations. The incident did not trigger visible contagion in regional trading volumes at press time.
For Southeast Asian crypto users and the exchanges that serve the region's more than 700 million people, the CoinDCX situation is a concrete reminder of how incomplete post-breach wallet hygiene can create ongoing exposure. The role of USDT in large exchange outflows across the TRON network is also worth monitoring, given Tether on TRON remains the dominant stablecoin for peer-to-peer remittances and exchange settlement across the region.
Security researchers and analysts have pointed to high-profile exchange incidents as a key risk factor for institutional confidence in centralized platforms. Discussions at regional events such as the AI Revolution Summit in India have increasingly included exchange security as a boardroom-level concern, reflecting how incident credibility affects not just user trust but also institutional capital allocation across Asian markets.
Whether the October 2026 outflows represent a fresh compromise, an unresolved tail from the July 2025 breach, or an operational accounting failure with no active-wallet exposure, the answer will hinge on on-chain evidence that has not yet been publicly produced. CoinDCX's prior handling of the $44 million July 2025 hack, where the exchange confirmed user credits and absorbed losses, suggests a playbook of internal resolution rather than public disclosure, a posture that security researchers say leaves too many questions unanswered for the wider market to independently assess.
TLDR Key Points
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on kanalcoin.com