Blockchain investigators are publicly challenging CoinDCX’s account of a reported $16 million security incident, alleging that the Indian crypto exchange misrepresented the origin and timing of suspicious wallet activity identified on October 22, 2026. The dispute concerns a TRON-based deposit address and whether funds that moved through it after a disclosed July 2025 hack were properly accounted for or were swept without users being informed.

The claims were also reported by Protos.

Investigators’ allegations

Investigator Darcy, working with security research group Salus, flagged roughly $16 million in suspicious movements from addresses believed to be connected to CoinDCX’s custody infrastructure.

The central wallet is a TRON-based address identified by the string TQKJQ. On-chain investigator ZachXBT said the deposit address remained in active use by a liquidity provider for 10 months after CoinDCX’s publicly disclosed July 2025 security incident, which the exchange has previously acknowledged. He also said the address received gas and swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.

The terminology matters for readers following the dispute: deposit addresses collect incoming customer funds, hot wallets hold the balances an exchange uses for day-to-day withdrawals, and gas is the fee a blockchain charges to process transfers. A sweep consolidates funds from one address into another, while a liquidity provider is an outside firm that supplies trading depth for an exchange’s markets.

ZachXBT published the following message on X, addressing CoinDCX directly:

CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team. Why are Indian… pic.twitter.com/S8WYtGNIjz

— ZachXBT (@zachxbt) October 22, 2026

The post is available through X and this direct X link.

ZachXBT characterized $15.8 million in user deposits as unaccounted for by CoinDCX’s team. That figure represents his on-chain interpretation of the TQKJQ wallet activity. It has not been independently audited or confirmed through a third-party forensic review.

What remains unverified

The central allegation—that the October 2026 movements represent a new or ongoing hack rather than activity connected to previously compromised wallets—remains disputed and unconfirmed. The available evidence did not include an independently verified block-explorer transaction set proving ownership attribution for the wallets involved. Public ledgers record transfers between addresses but do not identify who controls a wallet; attribution depends on confirmation from the exchange, its counterparties, or a forensic reviewer.

CoinDCX has not published a forensic postmortem or a regulatory filing specifically addressing the October 2026 movements. The available evidence therefore does not establish that a new hack occurred or that CoinDCX deliberately misled users.

CoinDCX’s response

CoinDCX publicly described claims about the addresses and transactions as misleading. The exchange said the flagged activity involved addresses created in early 2025 that were compromised during the July 2025 security incident and subsequently deprecated. It also said users had been advised not to deposit to the compromised wallet addresses.

In a follow-up statement, CoinDCX said the TQKJQ wallet activity was connected to those early-2025 addresses. The exchange maintained that the on-chain movements identified by investigators were attributable to the previously disclosed incident rather than a new breach.

CoinDCX’s statements are available through its X account and follow-up post. The exchange has not provided a date-ordered reconciliation of the transactions or publicly identified the liquidity provider referenced by ZachXBT.

The disagreement is primarily about timing and fund flows. CoinDCX’s account places the relevant compromise in July 2025 and treats the affected addresses as deprecated after the incident. ZachXBT’s on-chain interpretation places fund movements, gas transfers and hot-wallet interactions as recently as May 2026. If that interpretation is accurate, the exchange’s public disclosures would not cover the full operational lifecycle of the wallet.

Neither side has resolved that specific factual dispute with verifiable public documentation.

Coinbase’s recent CCI (India’s competition regulator) approval for a CoinDCX stake acquisition gives the incident additional significance, as institutional partners will scrutinize CoinDCX’s security posture and disclosure standards as part of ongoing due diligence. Further details on the approval are available in coverage of Coinbase’s CoinDCX stake approval.

Questions for CoinDCX users

For users who held USDT or other assets on CoinDCX in 2025 and 2026, the dispute raises custody and accounting questions that the exchange not addressed at the transaction level. USDT is a dollar-pegged stablecoin issued on several public blockchains, including TRON. CoinDCX’s “do not deposit” advisory indicates that it knew specific wallet addresses had been compromised. However, the public record does not show whether users who held funds in those addresses were individually notified or reimbursed.

Security-incident disclosures generally identify affected wallet addresses, provide an approximate estimate of fund exposure, and set out a timeline of the breach and response. If the TQKJQ address continued routing user deposits to CoinDCX’s hot wallet in April and May 2026, as ZachXBT’s analysis suggests, users depositing during that period may have sent funds to a wallet the exchange internally classified as compromised.

Publicly available CoinDCX communications do not state whether internal routing controls protected those users or whether they faced additional risk.

The broader market context adds pressure to the transparency issue. The Fear and Greed Index was reported at 68, in the “Greed” territory, indicating that exchange users were more risk-tolerant rather than more cautious at the time described. In such an environment, disclosure failures by centralized exchanges can create significant reputational consequences when they become public, because users may be less guarded when the information reaches them. The index is published by Alternative.me.

Evidence needed to resolve the dispute

The relevant on-chain record is publicly accessible on TRON’s ledger. A complete resolution would require several pieces of information that neither investigators nor the exchange has published in full.

These include a verifiable TRON explorer entry for the specific TQKJQ address showing its complete transaction history, timestamps, counterparty addresses and USDT amounts. Investigators would also need to establish the identity and contractual relationship of the liquidity provider cited by ZachXBT. Finally, CoinDCX would need to confirm or specifically refute the April and May 2026 transfers to its hot wallet described in ZachXBT’s post.

The most material unanswered question is whether CoinDCX’s current hot wallet received funds from TQKJQ after July 2025. If the transfers are confirmed on-chain, CoinDCX’s statement that the addresses were deprecated after the July 2025 incident would be factually incomplete.

Another unresolved issue is whether Indian financial regulators received an incident report concerning either the July 2025 breach or the October 2026 movements. No regulatory filing or enforcement action was identified in the available evidence.

The way centralized exchanges handle hot-wallet custody and security-incident disclosures is also relevant to the dispute. Comparisons between centralized-finance aggregators and decentralized-exchange protocols can provide context on differing custody models; coverage of that subject is available in this comparison.

The available evidence does not establish that CoinDCX lied or that a new hack occurred. It does establish an unresolved discrepancy between CoinDCX’s stated wallet-deprecation timeline and ZachXBT’s reported on-chain activity in April and May 2026.

Until CoinDCX provides a transaction-level reconciliation or a third-party auditor publishes a forensic report, users and counterparties do not have a complete public account of the custody and disclosure issues surrounding the wallets.