CoinDCX blames losses on failed old-wallet deposit sweep as ZachXBT alleges $15.8M gap
In brief
- CoinDCX said it absorbed operational losses after a sweep of deposits to retired addresses failed.
- CoinDCX gave no loss amount and did not say how long the process failed.
- ZachXBT alleged $15.8 million in user deposits was unaccounted for; CoinDCX denied a fresh breach.
- A 15,819,002 USDT transfer left the TQKJQ address on Oct. 21, CryptoSlate found.
What CoinDCX says happened
According to CoinDCX's Oct. 22 update, some users kept sending crypto to addresses it deprecated after its July 2025 security incident. The exchange said it had retired those addresses, but deposits kept arriving despite earlier warnings. Its sweeping process was meant to collect them regularly. CoinDCX said it only found the failure on the morning of Oct. 22.
The company said it credited the affected customer deposit wallets (active wallets weren't affected), and it maintained that customer assets are held in segregated cold wallets with trading continuing normally.
It didn't give a loss amount, and it didn't say how long the sweep had been broken.
A morning of denials
The timeline is messy. At 9:10 a.m. BST, CEO Sumit Gupta said CoinDCX wallets hadn't been breached. He described the flagged addresses as created in January 2025 and compromised in the July incident, adding that none of the exchange's current central or user addresses had sent money to them. Four minutes later, CoinDCX said it hadn't used those old addresses since July 2025 and that the reported activity had no connection to the exchange.
ZachXBT disputed that account at 9:52 a.m. BST.
He alleged the deposit address TQKJQ remained in use after the July 2025 incident, describing its use as lasting “for 10 months” after that incident.
He also alleged the address swept user deposits to CoinDCX's current public hot wallet and received transaction-fee funding. At 10:59 a.m. BST, Gupta said he was aware of the claim, that it was being investigated further, and that no user funds would be lost.
What the chain shows (and what it doesn't)
CryptoSlate's review of TronGrid and TronScan data shows a single successful transfer of 15,819,002 USDT from the address starting TQKJQ to another TRON address at 4:35:54 p.m. BST on Oct. 21. That confirms the tokens moved. It doesn't show who controlled either address, or whether customers lost funds.
The backdrop matters. Security firm Cyvers linked the July 2025 incident, roughly $44 million, to the Lazarus Group, and CoinDCX said its treasury covered that loss; Gupta's preliminary explanation on July 31 pointed to social engineering.
Two questions are still open: how much CoinDCX absorbed, and when the sweep failed. The Oct. 22 update doesn't answer either.
Frequently asked questions
What did CoinDCX say caused the losses?
CoinDCX said some users kept sending crypto to addresses it retired after its July 2025 security incident. A sweeping process meant to collect those deposits regularly failed, and the exchange said it found the failure on the morning of Oct. 22 and absorbed the operational losses.
Does the 15,819,002 USDT transfer prove CoinDCX customers lost funds?
No. CryptoSlate's review of TronGrid and TronScan data shows the tokens moved from the TQKJQ address on Oct. 21. The data doesn't show who controlled either address or whether customers lost funds.
