ZachXBT Flags $15.8M in Unexplained CoinDCX Deposits

ZachXBT Flags $15.8M in Unexplained CoinDCX Deposits

Blockchain researcher ZachXBT accused Indian crypto exchange CoinDCX of leaving roughly $15.8 million in user deposits unaccounted for, in a post published Thursday on X. His claim centers on a TRON deposit address beginning TQKJQ that, he says, a liquidity provider kept operating for about 10 months after the July 2025 security breach. Per his reading of the transaction history, the address kept sweeping user deposits into a wallet tagged as one of CoinDCX's current public hot wallets, while also receiving funds to cover transaction fees. Data from Arkham Intelligence that he shared shows a transfer of about 15,819,002 USDT dated October 21, 2026, plus smaller April and May 2026 transfers with addresses labeled as CoinDCX hot wallets. The on-chain record he cites also shows the current hot wallets sent gas to the compromised address as late as April 2026. His core request is narrow: the exchange should explain how the disputed deposits were accounted for, because they never surfaced in a transparent proof of reserves. The flagged assets are USDT on the TRON network, the same asset and chain combination that featured in the 2025 laundering trail.

@zachxbt · X post

Published Thursday on X.

View on X

CoinDCX Denies a New Breach

CoinDCX pushed back within hours. In an official statement, the company said the flagged addresses were generated in January 2025, were compromised during the July 2025 attack, and have not been used by the exchange since. Co-founder and CEO Sumit Gupta wrote that hackers appear to be reusing the old wallet addresses, calling the episode a possible false alarm. He added that analytics platforms still tag the legacy addresses as CoinDCX, which can make attacker reuse look like a fresh breach even when nothing touched current operations. The company's statement also asserted that no funds were sent from its operational wallets or customer custody addresses to the disputed legacy ones, that user assets are safe, and that trading services continue normally. Gupta separately answered the researcher directly: “Yes, aware of that,” the team was “investigating it further” and would share an update soon, with an assurance of “no user funds will be at loss.” The company has not yet published a wallet-by-wallet accounting of the October 21 movements, which is precisely the disclosure the researcher is demanding.

@CoinDCX · X post

An official statement.

View on X

The October 21 Transfer Trail

The dispute began with on-chain movements late on Wednesday, October 21. Darcy, co-founder of asset recovery platform FlashRescue, flagged transfers from addresses labeled as belonging to CoinDCX totaling about $15.99 million in USDT and 5,783.81 TRX. The single largest movement was roughly 15.82 million USDT. The funds first landed on an intermediary address, which was then emptied out, and part of the USDT reached Binance hot wallets as well as OKX and Gate. Darcy further claimed that two addresses listed in CoinDCX's latest proof of reserves had themselves sent funds to the flagged TRON address. The backdrop is a verified loss: on July 19, 2025, the exchange was drained of about $44 million through an operational account used for liquidity management. Customer wallets were untouched at the time, the loss was absorbed from company reserves, and a bounty program of up to $11 million was opened to recover the stolen assets. Exchange-tracking data over the past 24 hours puts CoinDCX's daily volume at about $1.15 million, a small operation whose most active pair is fiat against USDT.

Freezable Funds, Open Questions

COINOTAG's reading of the record: the on-chain evidence settles the 2025 event and leaves the 2026 dispute open. The attacker transaction history from July 2025 points to a root cause of a compromised operational account, and the team's own post-mortem at the time assigned the $44 million loss to company reserves, with the bounty program as remediation. What remains unproven is customer loss today: a large transfer from a labeled address is not by itself evidence of a new hack, and the $15.8 million figure has not been independently confirmed as a theft. Because most of the moved funds are USDT sitting on centralized venues, Tether or the receiving exchanges could freeze them, but only if CoinDCX formally confirms a loss. Until the company publishes a wallet-by-wallet accounting, users weighing exchange risk against self-custody in a hardware wallet have little verified disclosure to work from.