-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0268 ============================================================ Advisory-ID: 0xCERT-2026-0268 Severity: Critical Published: 2026-10-22T05:30:15.000Z Updated: 2026-10-23T20:44:33.074Z Chains: Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0268 Title: About $16M in USDT and TRX drained from CoinDCX hot wallet and deprecated deposit addresses on Tron Summary - ------- On 2026-10-21 about 15.99M USDT and 5,783.81 TRX moved from CoinDCX's hot wallet and deposit addresses to one Tron address. CoinDCX says the addresses were deprecated after its July 2025 compromise, that it absorbed the losses, and that users were credited. Do not deposit to old CoinDCX addresses. Details - ------- Summary On 2026-10-21 at 23:35:54 (UTC+8), on-chain analyst Darcy reported that CoinDCX's hot wallet and several of its deposit addresses sent about 15.99M USDT and 5,783.81 TRX to a single Tron address, with a largest single transfer of 15,819,002 USDT; the funds were then split and sent on to deposit addresses at Binance, OKX, Gate and others. CoinDCX first called the claims misleading, then stated that a sweeping process for deprecated deposit addresses had failed for a period, causing operational losses that it absorbed. Affected - - CoinDCX deposit addresses generated in early 2025 that, per CoinDCX, were compromised in its July 2025 security incident and later deprecated (including the address CoinDCX and ZachXBT refer to as "TQKJQ") - - Users who still deposit to deprecated CoinDCX deposit addresses - - Fixed in: not applicable (operational/key compromise); CoinDCX says current central and user addresses are not affected Impact DeFiLlama records the loss as $16M and classifies it as a hot-wallet key compromise. CoinDCX states that the transactions involve old addresses compromised in July 2025, that the losses were absorbed by CoinDCX, that affected users' deposits were credited, and that no funds from active wallets were compromised. Investigator ZachXBT disputed that the addresses were unused, saying the TQKJQ deposit address was in use for 10 months after July 2025 and swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026. The sources disagree on whether the wallets were in active use; CoinDCX has not called the event a hack, and no source has attributed the transfers to a named actor. Recommended actions - - CoinDCX users: only deposit to addresses currently shown in the CoinDCX app or website; never reuse old deposit addresses. - - Exchanges: screen and hold deposits traced from the Tron address listed in this advisory. Source & attribution This 0xCERT advisory summarises an alert by on-chain analyst Darcy (https://x.com/DarcyAri/status/2113140857717301483), statements by CoinDCX (https://x.com/CoinDCX/status/2113182200648864243 and https://x.com/CoinDCX/status/2113235810988531883), a post by ZachXBT (https://x.com/zachxbt/status/2113191832561778974), reporting by CoinDesk (https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows), and the DeFiLlama hacks database (https://defillama.com/hacks). Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/DarcyAri/status/2113140857717301483 - - https://x.com/CoinDCX/status/2113235810988531883 - - https://x.com/CoinDCX/status/2113182200648864243 - - https://x.com/zachxbt/status/2113191832561778974 - - https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows - - https://defillama.com/hacks Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmroI70JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmc1Y6hzHTEB74h1EWzYvIdDcJ5AMhVEGpj8ff1A 7aZ06BYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAC9UAD9F0aRS6T/OBmPSUK2 Nf6yahFffjhpu9+Al1d8YYqDDPwBALOzb5dpw3+kuCoOy8BTj/2ESmW8XMRx wOdfZxCfJ3wL =D5em -----END PGP SIGNATURE-----