Indian crypto exchange CoinDCX acknowledged operational losses from a failed deposit-sweeping process on October 22, 2026, reversing initial denials of a new security incident. The admission followed blockchain investigator ZachXBT's evidence showing that deprecated wallet address TQKJQ had processed transactions into 2026. CoinDCX confirmed that affected users were credited and that customer assets remain secure in cold wallets, though it has not disclosed the total financial loss absorbed.
Initial breach denial and updated statement
- ▪CoinDCX updated CEO Sumit Gupta's earlier denial of a breach on October 22, 2026, acknowledging operational losses caused by a failed deposit-sweeping process from deprecated wallet addresses
- ▪CoinDCX CEO Sumit Gupta initially stated on October 22, 2026 that about $16 million in reported suspicious outflows involved old addresses compromised in July 2025 and were unrelated to current operations
- ▪Indian cryptocurrency exchange CoinDCX initially denied that its active wallets were compromised following reportings of approximately $16 million in suspicious outflows on October 21, 2026
Deprecated wallet management and sweeping failure
- ▪CoinDCX reported that a temporary failure in its automated process for sweeping deposits from deprecated addresses caused operational losses that were discovered on October 22, 2026
- ▪CoinDCX stated that it credited all affected user deposit accounts for operational losses from a failed deposit-sweeping process, and that active customer funds remain safe in cold wallets
- ▪CoinDCX did not disclose the exact monetary size of the operational losses it absorbed from the failed deposit-sweeping process disclosed on October 22, 2026
- ▪CoinDCX stated that despite customer notifications to stop using deprecated deposit addresses after July 2025, some users continued sending cryptocurrency to them
- ▪CoinDCX deprecated deposit wallet addresses created in January 2025 following a security incident in July 2025
On-chain evidence and ZachXBT investigation
- ▪Blockchain records confirmed a transfer of 15,819,002 USDT from TRON address TQKJQ to another TRON address
- ▪ZachXBT alleged that CoinDCX deposit address TQKJQ swept user deposits to CoinDCX's public hot wallet and received gas funding as recently as April and May 2026
- ▪Blockchain investigator ZachXBT challenged CoinDCX's initial breach denial, alleging that deprecated deposit address TQKJQ remained active for 10 months following the July 2025 hack
July 2025 security incident
- ▪CoinDCX treasury funds covered the $44 million loss from the July 2025 security incident, which CEO Sumit Gupta attributed to social engineering
- ▪CoinDCX suffered a security incident in July 2025 resulting in the loss of approximately $44 million, which security firm Cyvers attributed to the Lazarus Group
Story comments
Loading comments…