🕵️ 15.99 million USDT transferred out. CoinDCX says “old addresses”; ZachXBT says they were “still in use in May”
Indian exchange CoinDCX has once again triggered on-chain alarm bells over the past couple of days.
According to on-chain security researcher Darcy, at 23:35 Beijing time on October 21, CoinDCX’s hot wallet and several deposit addresses transferred approximately 15.99 million USDT and 5,783.81 TRX to the same TRON address. The largest transfer was 15,819,002 USDT. Media outlets including BeInCrypto reported that the funds were subsequently split up and sent to deposit addresses at Binance, OKX, and Gate.
CoinDCX’s response: These addresses were created in January 2025 and compromised during the security incident that July. The company says it hasn’t used them since, and that users’ funds are safe. Co-founder Sumit Gupta also said the current wallets were unaffected.
(Additional context: CoinDCX lost approximately $44 million in July 2025.)
But ZachXBT isn’t convinced:
🔹 He says the deposit address TQKJQ was used for about 10 months after the incident last July
🔹 Deposits from users were still being consolidated into CoinDCX’s now-public hot wallet as recently as April and May this year
🔹 According to him, approximately $15.8 million in user deposits “was not accounted for by the team”
The two accounts don’t currently line up. I’m not taking sides and will wait for more on-chain evidence. But there are two things ordinary users should keep in mind:
First, “the address was abandoned long ago” and “the address is still receiving funds” are two different things. If an exchange abandons an address without fully disabling it on the user side, users can still send funds to it.
Second, don’t use “the address you saved last time” to make a deposit. Copy it afresh from the app every time and check the first and last few characters. It costs almost nothing to make this a habit.
When you make a deposit, do you copy the address again each time, or use a frequently used address? 👇
#CoinDCX #链上安全 #USDT #ZachXBT
Indian exchange CoinDCX has once again triggered on-chain alarm bells over the past couple of days.
According to on-chain security researcher Darcy, at 23:35 Beijing time on October 21, CoinDCX’s hot wallet and several deposit addresses transferred approximately 15.99 million USDT and 5,783.81 TRX to the same TRON address. The largest transfer was 15,819,002 USDT. Media outlets including BeInCrypto reported that the funds were subsequently split up and sent to deposit addresses at Binance, OKX, and Gate.
CoinDCX’s response: These addresses were created in January 2025 and compromised during the security incident that July. The company says it hasn’t used them since, and that users’ funds are safe. Co-founder Sumit Gupta also said the current wallets were unaffected.
(Additional context: CoinDCX lost approximately $44 million in July 2025.)
But ZachXBT isn’t convinced:
🔹 He says the deposit address TQKJQ was used for about 10 months after the incident last July
🔹 Deposits from users were still being consolidated into CoinDCX’s now-public hot wallet as recently as April and May this year
🔹 According to him, approximately $15.8 million in user deposits “was not accounted for by the team”
The two accounts don’t currently line up. I’m not taking sides and will wait for more on-chain evidence. But there are two things ordinary users should keep in mind:
First, “the address was abandoned long ago” and “the address is still receiving funds” are two different things. If an exchange abandons an address without fully disabling it on the user side, users can still send funds to it.
Second, don’t use “the address you saved last time” to make a deposit. Copy it afresh from the app every time and check the first and last few characters. It costs almost nothing to make this a habit.
When you make a deposit, do you copy the address again each time, or use a frequently used address? 👇
#CoinDCX #链上安全 #USDT #ZachXBT