CoinDCX argued that the suspected $16 million in outflows were not connected to its active wallets, while ZachXBT claimed an old deposit address was still used in spring 2026.
CoinDCX, India’s largest cryptocurrency exchange, denied claims of an attack after suspicions arose that approximately $16 million worth of USDT and TRX had left its wallets. A spokesperson for the exchange told CoinDesk that the transactions were linked to old addresses that had not been used since the July 2025 attack, and said the current addresses were unaffected.
X user Darcy was the first to draw attention to the suspicious outflows. The exchange had lost approximately $44 million in the same attack.
On-chain investigator ZachXBT challenged the exchange’s statement. The investigator claimed that the deposit address labeled TQKJQ was used for 10 months after the attack and forwarded user deposits to CoinDCX’s current hot wallet in April–May 2026.
CoinDCX credited deposits sent to old addresses
CoinDCX said it had warned users not to deposit funds to addresses retired after the attack, but that some people continued to send deposits to those addresses. According to the exchange, an automated process that was supposed to transfer such deposits to its main wallet was disrupted for a time, and the balances of all affected users were credited to their accounts.
The company said customer assets are held in cold wallets, current central and user addresses were unaffected, and transactions continued as normal.
Not investment advice.