Indian cryptocurrency exchange CoinDCX has acknowledged failures in its deposit-processing system after nearly $16 million in USDT was transferred from wallets linked to the platform, reversing an earlier explanation that the suspicious activity involved only abandoned addresses.

The October 22 admission followed accusations from blockchain investigator ZachXBT, who challenged the exchange's claim that the flagged wallets had been inactive since a $44 million security breach in July 2025. CoinDCX now acknowledges that deposits continued reaching those addresses and that its process for collecting the funds had failed for a period.

The company maintains that affected customers were credited, that operational losses have been absorbed internally, and that assets held in its active custody infrastructure remain secure.

Nearly $16 Million in USDT Moved Through TRON Wallets

The suspicious transfers began on October 21, when approximately 15.99 million USDT and 5,784 TRX moved from addresses associated with CoinDCX into a newly created TRON wallet.

Blockchain security researcher Darcy first flagged the transactions, identifying transfers from multiple deposit addresses and wallets previously attributed to the exchange. The largest single transaction involved 15.82 million USDT leaving one deposit address. The receiving wallet subsequently distributed the funds across several addresses, with substantial amounts eventually reaching accounts associated with Binance, OKX and Gate.

A detailed transaction by blockchain analytics firm Bitquery identified approximately 40 affected wallets, including addresses that continued processing deposits after the July 2025 incident. By October 22, roughly $9.63 million had reached identified exchange deposit addresses, while another $2.28 million remained in seven downstream wallets at the time of Bitquery's analysis.

ZachXBT Challenges CoinDCX's Initial Denial

CoinDCX initially rejected the allegations, explaining that the flagged addresses had been created in January 2025, compromised during its previous security incident and discontinued. Co-founder and CEO Sumit Gupta separately maintained that no active company or customer wallets had transferred funds to the affected addresses.

ZachXBT challenged that account, identifying a deposit address beginning TQKJQ that remained connected to the exchange's operational infrastructure for months after the previous breach. The address continued receiving TRX for transaction fees and transferring deposits to CoinDCX-linked hot wallets as recently as April and May 2026. Bitquery identified 88 deposits totaling approximately $15.82 million that had accumulated in the address between January and March before being transferred out during the October incident.

The exchange's revised explanation acknowledged that users had continued depositing cryptocurrency into deprecated addresses despite instructions to stop using them. CoinDCX had maintained an automated process to collect those deposits, but acknowledged that sweeping had failed for a period, resulting in operational losses.

The mechanics behind that shortfall are a familiar operational hazard for centralized exchanges: deposit addresses retired on paper often keep receiving user funds, and platforms typically run automated sweeps to collect the stray deposits and credit customer balances. When the sweeping process fails, an exchange can end up owing user balances on assets it never actually collected — the gap CoinDCX says it has absorbed internally rather than passing on to users.

ZachXBT subsequently accused the exchange of lacking transparencyhttps://x.com/zachxbt/status/2113264816546873716), criticizing its initial rejection of the transaction evidence before the processing failures were acknowledged. The episode also illustrates the accountability role public blockchain data now plays: CoinDCX's initial denial stood until the underlying on-chain evidence — deposit addresses still tied to its infrastructure months after the breach — was documented and published by independent investigators and analytics firms.

CoinDCX Says Customers Were Credited and Funds Remain Safe

Under its revised position, all customer deposits sent to deprecated addresses were credited to user accounts, even when the corresponding assets had not been successfully collected. The company maintains that its current operational wallets were not compromised and that customer assets remain protected in segregated cold storage. Trading and other exchange services continue operating normally. For users, the episode also underscores that deposits sent to deprecated addresses depend on an exchange's internal processes for both crediting and recovery.

The exchange previously absorbed approximately $44 million in losses following its [July 2025 security breach, when attackers compromised an internal operational account used for liquidity provisioning. CoinDCX had also faced earlier questions about its custody arrangements, rejecting allegations involving the movement of Indian customer assets to an overseas entity.

The dispute comes amid continued scrutiny of centralized cryptocurrency exchanges in India, where the WazirX restructuring followed a separate $230 million security breach that left customers waiting for repayments. ZachXBT has also previously criticized KuCoin over its handling of stolen cryptocurrency reports, including allegations that exchange deposit accounts were not frozen quickly enough.

CoinDCX has not publicly provided a complete reconciliation of the affected deposit balances, the final value of its operational losses or the status of any recovery efforts involving the transferred USDT. Its customer-credit assurances have not been independently reconciled against the exchange's internal accounting records. Those open items — a full reconciliation, a final loss figure and any recovery updates — are the key disclosures to watch as the situation develops.