No smoke without fire. On Wednesday morning, the CEO of CoinDCX spoke of a “false alarm” about funds siphoned off the Tron blockchain. The Indian exchange ended up recognizing yesterday a loss of 15.99 million USDT, or approximately $16 million, on old addresses already compromised during the July 2025 hack.
This first hack had already cost the platform $44 million. On-chain detective ZachXBT is now advising customers to remove everything.
CoinDCX: from “false alarm” to “operational losses”
It all starts on Tuesday, October 20, at 11:35 a.m. New York time. Around 15.99 million USDT and 5,783 TRX then leave a CoinDCX hot wallet, this permanently connected wallet, as well as several of its deposit addresses. Single destination, a Tron address. The largest transfer weighs 15,819,002 USDT alone. The co-founder of FlashRescue, known by the pseudonym Darcy, followed suit. The funds are cut up and then dispersed to deposit addresses at Binance, OKX and Gate.
Darcy sounds the alarm on X Wednesday at 1:30 a.m. New York time. CEO Sumit Gupta responded in less than three hours that the information was “incorrect” and that CoinDCX wallets had “not been hacked”. The targeted addresses would have been compromised as early as July 2025. “It looks like a false alarm,” he says. The official account of the exchange followed up four minutes later and described the reports as “misleading”.
The tone changes quickly. At 5:59 a.m., Gupta assures ZachXBT that the team is "investigating further" and that "no user funds will be lost." At 7:47 a.m., CoinDCX admits that an outage in its automatic transfer service caused “operational losses, absorbed by CoinDCX.” Without the slightest amount. We will have to wait until Sunday and a blog post to read the figure of 15.99 million USDT, noted by The Block on October 25.
Broken scanning, Achilles heel of CoinDCX
The heart of the problem lies in a sentence from the CoinDCX post. Its “automated scanning service,” which moves funds from one wallet to another, “failed for a period of time.” Translate. Each customer of an exchange receives a deposit address, which a robot regularly empties into better-guarded wallets. Robot stopped, money piles up where it should never sleep.
And the place was poorly chosen. These addresses belonged to the old infrastructure, the one that the exchange itself describes as carrying “unknown vulnerabilities”. Deposits continued to arrive at compromised addresses without anyone emptying them, and the attacker just had to duck.
Why were these addresses still receiving money fifteen months after the hack? ZachXBT offers an explanation. According to him, one of them served a liquidity provider for ten months after the incident in July 2025. It was still transferring customer deposits to the current CoinDCX hot wallet in April and May 2026. The detective mentions “$15.8 million in user deposits that your team did not account for”.
The hackers in July 2025 had emptied an operational account used to provide liquidity on a partner platform, according to the founders cited by the Deccan Herald. Bengaluru police later established that scammers posing as recruiters had convinced an engineer to install malware on his work computer.
ZachXBT urges CoinDCX customers to withdraw everything
The detective did not wear gloves. “Withdraw all your funds from CoinDCX if you value your assets,” he told his subscribers. For ZachXBT, co-founders who denied the theft in public and private have either “outright lied” or demonstrated “culpable incompetence”. He also claims to have helped freeze a six-figure sum on behalf of the platform.
CoinDCX maintains that customer funds lie dormant in separate cold wallets, offline wallets, and that deposits, withdrawals and exchanges operate normally. Questioned by The Block, the exchange's press relations agency referred to the blog post without answering specific questions.
The matter is at its worst. Coinbase invested in CoinDCX in October 2025, at a valuation of $2.45 billion put forward by Gupta. Indian police arrested Gupta and his co-founder Neeraj Khandelwal in March after a fraud complaint. The exchange then accused scammers of having usurped its identity with a clone site.
