At 11:35 a.m. ET on Tuesday, funds left a CoinDCX wallet. Early Wednesday, FlashRescue co-founder Darcy posted a timeline: approximately 15.99 million USDT, along with 5,783 TRX, flowed out of a hot wallet and a deposit address. The largest transaction was worth more than 15.81 million USDT. According to his tracking, the funds were then split up and transferred to deposit addresses at Binance, OKX, and Gate.

Less than three hours later, CoinDCX CEO Sumit Gupta replied that the wallet hadn’t been hacked and that it sounded like a false alarm. Four minutes later, the company’s official account followed up, saying the addresses hadn’t been used since the July 2025 incident and that the claims were misleading.

On-chain records don’t support that explanation. ZachXBT posted evidence: one address continued to be used for 10 months after July 2025, and deposits were still being swept into the current hot wallet in April and May this year. He did the math: around $15.8 million in user deposits that the company has never clearly accounted for.

That morning, Gupta changed his tune, saying an investigation was underway. The company later acknowledged in a post that its consolidation system had been down for a while and that it would make customers whole, but gave no figures. It wasn’t until a blog post on Sunday morning that CoinDCX admitted the amount: 15.99 million $USDT had been lost. The company said that while the consolidation system was down, user deposits kept flowing into an address that should have been decommissioned long ago.

CoinDCX had already lost around $44 million in July 2025. According to CryptoBriefing, Tether froze around $2.21 million in related USDT on October 22; the company had to bear the remaining shortfall itself. My take: the promise to make customers whole is fine on its own. The hard part is that it came after a false alarm.

ZachXBT ultimately told users to withdraw their assets if they cared about them. You can decide for yourself how harsh that sounds.