News analysis ·
CoinDCX's $16 million loss: what the wallet trail showed
CoinDCX denied, then admitted a $16 million loss from a retired Tron wallet. How on-chain sleuths linked the address, and what the trail cannot prove.
CoinDCX, the Mumbai-based exchange that CoinDesk describes as India's largest by trading volumes, has admitted a loss of 15.99 million USDT from a wallet it had retired, after first calling the reports a false alarm. The exchange says it absorbed the roughly $16 million itself. This article looks at how outside researchers tied a supposedly abandoned address back to the exchange, and what that kind of trail can and cannot prove.
What the incident shows
According to Decrypt, the transfers took place on the Tron network on Oct. 21. The Arkham tracker and independent blockchain researchers were the first to notice that roughly $16 million had left exchange-connected addresses in a pattern they considered suspicious.
CEO Sumit Gupta replied on X that CoinDCX wallets were not breached and called the reports a false alarm. A spokesperson told CoinDesk that the flagged addresses were created in January 2025, were compromised in the July 2025 hack, and had not been used by the exchange since.
That position did not hold. CoinDCX later published a blog post saying the address in question was part of its old operational wallet setup, compromised in the incident it reported on July 19, 2025, and deprecated afterward. The post said users had kept sending deposits to retired addresses, that a sweeping service meant to move those funds onward had failed for a period, and that deposits piled up as a result.
The method: following deposit sweeps on a public ledger
The key piece of evidence came from on-chain investigator ZachXBT. He said that at least one flagged address, labeled TQKJQ, was used by a liquidity provider and forwarded user deposits to the current public CoinDCX hot wallet during April and May 2026. A hot wallet is an exchange wallet kept online so it can process withdrawals quickly.
This is a standard on-chain analysis technique. Exchanges usually give each customer a deposit address, then run an automated job, called sweeping, that collects those deposits into a central wallet. Every sweep is a public transaction. If an address keeps sending funds to a wallet the exchange has publicly identified as its own, that pattern links the two, whatever the company says about the address being out of use.
So the argument needed no inside access: a known exchange wallet, the transfers into it, and their dates. Recent sweeps from an address described as unused since 2025 were enough to challenge the official account.
Is a crypto wallet traceable? What this case says
On a public blockchain like Tron, the movement of a wallet's funds is visible to anyone, and so is every address it pays. What is not written on the chain is who controls an address. That link comes from labels: an exchange publishing its hot wallet, a tracker tagging an address, or a pattern like repeated deposit sweeps. In this case the labels and the sweep history together tied TQKJQ to CoinDCX's wallet flow.
Limits of the trail
A clear trail of transfers still leaves several questions open. CoinDesk noted that the blog post does not describe the event as a hack and does not say who moved the funds or how. CoinDesk also said it asked CoinDCX whether the retired addresses had been hacked again.
- Movement is not motive. The chain shows funds leaving an address, not whether that was theft, an error or an authorised transfer.
- Control is inferred. Linking an address to an exchange rests on labels and patterns, which can be incomplete or out of date, as the conflicting claims here show.
- Reserves are off-chain claims. CoinDCX said user funds sit in segregated cold wallets with multi-layer custody and offline controls, but that statement is not something a single address trail can verify.
- Old keys stay dangerous. An address compromised once can keep receiving deposits from users who never updated their records, so a retired wallet is not automatically a safe one.
Background and what to watch next
This is not the exchange's first loss. Decrypt reported that CoinDCX lost roughly $44 million in a July 2025 hack it blamed on a server breach, which led to a bounty hunt and later the arrest of an employee. Per Decrypt, the combined losses from both incidents come to nearly $60 million. ZachXBT urged customers to pull their assets from the platform, according to Decrypt.
In its post, quoted by CoinDesk, the company said: "We could have been more proactive, but we shared this update as soon as we had the complete picture". CoinDCX said it will share more details as its investigation continues and that user balances are unaffected.
Worth watching: whether the exchange names who moved the funds and how, whether it answers CoinDesk's question about a second compromise, and where the Oct. 21 transfers go next on Tron. For users, the simplest habit is to copy a fresh deposit address from the exchange app each time. Keeping crypto on any exchange carries risk, and you can lose money if a platform is compromised or fails.
Sources
Drafted by AI from the research and on-chain sources listed, then published automatically once checks confirmed the figures against those sources and found no copied text. Not reviewed by a person. Metrics are explained, never turned into price calls.