Well-known blockchain investigator ZachXBT has told users of Indian crypto exchange CoinDCX to withdraw their money. He accused the exchange’s founders of first denying a roughly $16 million loss and only later admitting it.
“Withdraw all funds from CoinDCX if you value your assets,” ZachXBT wrote on X. He called its co-founders “clowns running a circus.”
How It Started
On October 21, on-chain trackers flagged about $15.99 million in USDT moving out of a wallet linked to CoinDCX. The money was split up and sent to deposit addresses on Binance, OKX and Gate.
CoinDCX co-founder Sumit Gupta quickly dismissed the reports. He said the addresses were old ones compromised in the exchange’s July 2025 hack and that none of CoinDCX’s current wallets had been breached. He called it a false alarm and asked people not to spread rumours.
What ZachXBT Found
ZachXBT said the wallet in question, which starts with “TQKJQ,” was not abandoned. According to him:
- A liquidity provider kept using it for 10 months after the July 2025 hack.
- It continued to collect user deposits and pass them to CoinDCX’s current public hot wallet, as recently as April and May 2026.
- That meant about $15.8 million in user deposits had not been accounted for by the CoinDCX team.
CoinDCX’s Explanation
CoinDCX later posted a fuller update. It said:
- The wallet was compromised in July 2025 and later retired, and users had been told not to send funds to it.
- Some users kept depositing to the old address anyway.
- An automatic process meant to sweep those deposits into secure wallets stopped working for a period, and the company only noticed on the morning it posted the update.
- The resulting “operational losses” were absorbed by CoinDCX, and every affected user deposit was credited.
- Customer assets are kept in separate cold wallets, and trading is running normally.
The exchange did not give a dollar figure for the loss.
Why ZachXBT Is Angry
ZachXBT said CoinDCX denied the theft both publicly and privately before confirming the loss. In his view, that means the team “straight up lied” or was “negligently incompetent.” He grouped CoinDCX with WazirX and BitBNS, two other Indian exchanges that have faced security problems. He also said he still helped CoinDCX freeze a six-figure amount of the stolen funds.
On-chain tracking account Onchain Lens said the funds appear to be moving through little-known services and mixing platforms. It added that the amount drained almost exactly matches the user deposits that went to the untracked wallet.
The Questions Still Open
Critics on X want answers on three points:
- How a failed sweeping process could lead to losses of about $15 million to $16 million
- Why users could still send money to an address that had supposedly been retired
- Why the exchange did not block old deposit addresses automatically
CoinDCX has asked users to rely only on its official channels for updates.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
