About $16M in USDT and TRX drained from CoinDCX hot wallet and deprecated deposit addresses on Tron

Summary

On 2026-10-21 at 23:35:54 (UTC+8), on-chain analyst Darcy reported that CoinDCX's hot wallet and several of its deposit addresses sent about 15.99M USDT and 5,783.81 TRX to a single Tron address, with a largest single transfer of 15,819,002 USDT; the funds were then split and sent on to deposit addresses at Binance, OKX, Gate and others. CoinDCX first called the claims misleading, then stated that a sweeping process for deprecated deposit addresses had failed for a period, causing operational losses that it absorbed.

Affected

• CoinDCX deposit addresses generated in early 2025 that, per CoinDCX, were compromised in its July 2025 security incident and later deprecated (including the address CoinDCX and ZachXBT refer to as "TQKJQ")
• Users who still deposit to deprecated CoinDCX deposit addresses
• Fixed in: not applicable (operational/key compromise); CoinDCX says current central and user addresses are not affected

Impact

DeFiLlama records the loss as $16M and classifies it as a hot-wallet key compromise. CoinDCX states that the transactions involve old addresses compromised in July 2025, that the losses were absorbed by CoinDCX, that affected users' deposits were credited, and that no funds from active wallets were compromised. Investigator ZachXBT disputed that the addresses were unused, saying the TQKJQ deposit address was in use for 10 months after July 2025 and swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026. The sources disagree on whether the wallets were in active use; CoinDCX has not called the event a hack, and no source has attributed the transfers to a named actor.

Recommended actions

• CoinDCX users: only deposit to addresses currently shown in the CoinDCX app or website; never reuse old deposit addresses.
• Exchanges: screen and hold deposits traced from the Tron address listed in this advisory.

Source & attribution

This 0xCERT advisory summarises an alert by on-chain analyst Darcy (https://x.com/DarcyAri/status/2113140857717301483), statements by CoinDCX (https://x.com/CoinDCX/status/2113182200648864243 and https://x.com/CoinDCX/status/2113235810988531883), a post by ZachXBT (https://x.com/zachxbt/status/2113191832561778974), reporting by CoinDesk (https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows), and the DeFiLlama hacks database (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record.