Tether Blacklists USDT Wallets Linked to $16 Million in CoinDCX Outflows
Key Takeaways
- •Tether's blacklisting of TRON addresses linked by AMLBot to roughly $16 million in CoinDCX-associated outflows has frozen about $2.2 million in USDT so far.
- •Contract event logs confirm three AMLBot-named addresses were blacklisted, with approximately 1.385 million USDT frozen across them as of Oct. 22, plus about $800,000 frozen across five additional wallets.
- •AMLBot's tracing tied the Oct. 21 draining of roughly 40 CoinDCX-linked deposit addresses to about $5.5 million deposited at OKX, $2.8 million at Binance, and $1.4 million at Gate, with a large share passing through unidentified services.
- •ZachXBT challenged CoinDCX co-founder Sumit Gupta's denial of a new breach, saying a compromised deposit address remained in use for 10 months after the July 2025 incident and alleging $15.8 million in user deposits went unaccounted for.
- •CoinDCX acknowledged its deposit-sweeping process failed for a period, causing operational losses it absorbed, and stated that affected users were credited while its active central and user wallets were unaffected.
Tether has blacklisted a set of TRON wallets that blockchain-tracing firm AMLBot has linked to roughly $16 million in outflows from addresses associated with crypto exchange CoinDCX, freezing about $2.2 million in USDT so far.
Event logs from the $USDT contract confirm the blacklisting of three addresses specifically named by AMLBot. Tronscan's blacklist records showed approximately 1.385 million $USDT frozen across those three wallets as of 6:45 p.m. ET on Oct. 22. AMLBot said roughly $800,000 more was frozen across five other addresses.
The tool at work here is a contract-level control Tether holds as USDT's issuer on TRON: once an address is listed, transfers of the token to and from that address are blocked, converting tracing work into balances that are effectively immobile on platforms that honor the issuer's list.
The action targets funds downstream of the disputed outflows but does not establish who controlled the original deposit wallets. CoinDCX has since acknowledged that users continued depositing to addresses compromised in July 2025 and that a failure to move those deposits into secure wallets caused losses the exchange says it absorbed.
AMLBot Tracks Pre-Freeze Movement
In an Oct. 23 update, AMLBot said two wallets it had previously been monitoring moved their funds one more address along before the freeze. One split the funds between two recipients, while the other sent them to a third. "All three are now frozen," the firm wrote.
The three blacklisted recipients named in that update were:
TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a, with approximately 664,939 $USDT frozenTETvPCoHdB6KorVS3PL1jxfhh78B7KZKG, with approximately 400,995 $USDT frozenTGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs, with 319,000 $USDT frozen
AMLBot's earlier tracing report said roughly 40 CoinDCX-linked deposit addresses were drained on Oct. 21, with funds converging on TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT. The firm attributed subsequent deposits of about $5.5 million to OKX, $2.8 million to Binance, and $1.4 million to Gate, while noting that a large share passed through unidentified services.
The gap between the roughly $16 million traced and the approximately $2.2 million frozen so far means most of the funds remain outside the blacklist—some now sitting on centralized exchanges, and much of it having passed through services AMLBot could not identify. What happens to that remainder depends on those platforms' own controls and on any additional addresses Tether chooses to list.
CoinDCX Acknowledges Deposit-Sweeping Losses
As The Defiant previously reported, CoinDCX co-founder Sumit Gupta initially denied a new breach, saying the flagged wallets were old addresses compromised in July 2025.
On-chain investigator ZachXBT challenged that account, saying the deposit address abbreviated TQKJQ had remained in use by a liquidity provider for 10 months after the incident. He said it had sent user deposits to CoinDCX's current public hot wallet as recently as April and May 2026, and alleged that $15.8 million in user deposits had gone unaccounted for.
The dispute centers on a structural feature of exchange operations: deposit addresses are published for customers to send funds to, so an address left active after a compromise keeps receiving money until it is explicitly retired. That dynamic is what made the months-long overlap between the compromised addresses and CoinDCX's active wallets consequential.
CoinDCX's subsequent statement acknowledged that deposits had continued to deprecated addresses despite its warnings. The exchange said its regular "sweeping" process—moving deposits out of those wallets so they could be accounted for and secured—had failed for a period.
"This failure led to some operational losses, which were absorbed by CoinDCX," the exchange said. It added that affected users had been credited, while maintaining that its current central and user addresses were unaffected and that no funds from active wallets had been compromised.
Beyond the blacklists, the open questions are whether the frozen total climbs further, whether OKX, Binance, or Gate act on or comment on the deposits AMLBot attributed to them, and whether CoinDCX details how long its sweeping failure lasted.
