A thief took $15.99M from 40 CoinDCX wallets. CoinDCX was still using them that morning

01 · What happenedCoinDCX wallets were emptied, and the exchange called them old

On the evening of 21 October, about $16 million left wallets belonging to CoinDCX. CoinDCX is one of India's biggest crypto exchanges. The money went to one new address. Within hours it was split up and sent on to other exchanges.

The coins were USDT, the dollar stablecoin, on TRON, the blockchain most exchanges use to move USDT cheaply. Darcy, who works at the security firm Salus, was first to flag the transfers, in a post early the next morning. CoinDCX replied that users' funds were safe and that the wallets were old addresses, created in January 2025 and compromised in its July 2025 hack. They "have not been used by CoinDCX since", it added. Co-founder Sumit Gupta added that none of the exchange's current addresses had sent money to them.

Bitquery reads TRON's full public record, so we tested that claim wallet by wallet. It does not hold up. The exchange's own system was moving customer deposits through the drained wallets on the morning of the theft. CoinDCX's treasury had been refilling one of them all year. We also traced where the money came from and where it went. What the record cannot show is how the thief got the keys.

02 · How a deposit movesDeposit addresses, hot wallets and the fee that moves them

When you send USDT to CoinDCX, the app gives you a deposit address of your own. A program the exchange runs, usually called a sweeper, watches all of those addresses. When a deposit lands, it moves the coins into a hot wallet, the wallet the exchange uses for day-to-day payments. Exchanges keep most of their money offline in cold wallets, also known as treasury wallets. They top up the hot wallets from there.

On TRON, each USDT transfer costs a small fee, which crypto people call gas. It is paid in TRX, TRON's own coin. A fresh deposit address holds no TRX, so before each move CoinDCX sent it 15 TRX from a hot wallet whose address starts with TFLx.

A deposit address only moves money when someone with its private key tells it to. So if the exchange's sweeper was still moving deposits through these addresses in October, CoinDCX still held the keys and was still using them. The full TRON record behind this check, block by block, is open through Bitquery's TRON API.

03 · The night of 21 OctoberFive minutes between CoinDCX's last move and the thief's first

That morning the hot wallet that collects deposits, TU7Bb, passed a batch of them on to a treasury wallet. Just after noon UTC, TFLx sent its usual 15 TRX to one of the deposit addresses. Seconds later that address moved its deposit into the collecting wallet.

Five minutes later the same wallet, TFLx, paid 100 TRX into a brand-new address. That was the thief's first move. Over the next half hour TFLx sent the new address all its USDT and all its TRX. That TRX paid for each deposit move.

The thief tested with small amounts through the afternoon, then emptied 35 deposit addresses, one after another, into the new address. About 20 minutes later the big one followed, 15.8 million USDT from a single deposit address, TQKJQr.

CoinDCX's own system kept running. More than five hours after the theft, it moved a small deposit from a second address into the collecting wallet. It had done the same all year.

The thief also held the keys to two older wallets of the exchange. One was a hot wallet that went quiet in October 2023. The other was funded by a CoinDCX cold wallet earlier that year. So the thief held keys the exchange had retired long ago as well as keys it used every day. That points to access to a whole store of keys.

04 · Still in useThe exchange moved deposits through these wallets until the day of the theft

CoinDCX's statement says these addresses fell out of use after the July hack. The record shows the opposite.

Start with the deposit addresses. All 35 small deposit addresses the thief emptied had a deposit moved out by the exchange after 1 September. For 22 of them it happened in the final week. Their money went into TU7Bb, the hot wallet that collects deposits, and on into the treasury.

The fee wallet points the same way. TFLx kept sending 15 TRX top-ups every month after the July hack, apart from two gaps. Since August it sent 276 of them. Each one was followed by a deposit move into the collecting wallet, usually within half a minute. That is a program at work, and the money it moved landed in CoinDCX's hot wallet.

The treasury wallets point the same way. They kept the fee wallet topped up with TRX this spring and summer. Last year one of them also sent TFLx more than $27M in USDT. Bitquery's address labels mark these as CoinDCX wallets, and they were moving money on the day of the theft. Gupta's point was that no current address had paid these old ones. These payments say otherwise.

05 · The $15.82 millionOne deposit address held 99% of what was taken

Almost all the money came from TQKJQr. It belonged to one big depositor. ZachXBT says it was a liquidity provider. Over 14 months that depositor paid in more than $100M. CoinDCX moved each deposit on within a minute, $85M of it in all. The sweeper was thorough. In May it even passed on four tiny transfers from a look-alike address, the calling card of address poisoning scams.

Then the moves stopped for one stretch. The 88 deposits that arrived from late January to the end of March were never moved. Together they come to exactly the amount the thief took from this address. To the cent.

Why those deposits stayed there is not clear from the record. In those same weeks TFLx sent no top-ups at all, until the treasury refilled it on 1 April. But TQKJQr held enough TRX of its own to pay for a move. And on 11 March CoinDCX swept 518 other deposit addresses in six minutes and left this one, which by then held more than $9 million. When top-ups came back, each new deposit was moved on within a minute. The old pile stayed exactly where it was until the thief came for it in October.

There are two ways to read that. If the exchange had credited those deposits to the depositor, the theft cost it the money. If it had not, a customer's deposits went uncredited for months. Only its books can say which.

06 · Where the money wentOKX, Binance and Gate within a day

The thief started moving the money in the early evening, UTC. Over the next ten hours the new address split it across six wallets, four of them brand new, and from there it fanned out. The first deposit at Binance landed half an hour later, and by the next morning $9.63M had reached deposit addresses at OKX, Binance and Gate.

Binance sent about 159,000 USDT back out to one of the thief's wallets, which looks like a withdrawal from the account the thief had just paid into. Exchange accounts come with names and IDs, so these deposits are where investigators can reach a person.

Another $4.1M went into busy wallets that hundreds of other people pay into, most of it to a single wallet. We could not tell who runs them. A little over $100k left TRON through the USDT0 and Bridgers bridges.

At the time of writing, $2.28M was still sitting in seven wallets on the thief's side. Around noon UTC on 22 October the thief moved three of those balances to three new wallets. None of it went to an exchange. Tether, the company that issues USDT, can freeze USDT on any TRON address, and it froze millions within hours in the Ledger CryptoBilis theft. It had frozen none of these.

07 · The claimsWhat the record says about each claim

Here is each public claim set against the chain. The posts are CoinDCX's statement, Gupta's reply, Darcy's follow-up and ZachXBT's reply to CoinDCX.

The wallets' age is the easiest claim to test. CoinDCX says they were created in January 2025. Most were in use long before that, and none started that month. Three deposit addresses got their first deposit after the July 2025 hack, and CoinDCX swept them like any other.

Darcy's follow-up also asked whether CoinDCX had taken its users' money itself. Nothing in the record points that way. None of the stolen USDT went back to a CoinDCX wallet; it went through new wallets, in round amounts, to other exchanges, which is how thieves usually cash out.

08 · Is CoinDCX safe?What this means for CoinDCX users

CoinDCX says users' funds are safe and trading goes on as usual. The TRON record can neither confirm nor rule that out. The record shows wallets. Customer balances sit in the exchange's own books. We only checked TRON.

What the record does show is that keys to wallets the exchange was still using ended up with someone else. It also shows that CoinDCX's first answer did not match its own wallets' history. In July 2025 CoinDCX said it would cover a $44M loss from its treasury. This time it has not yet said whether the drained deposits were credited, or when it last used these keys. Both answers sit in its own records.

If you sent USDT on TRON to CoinDCX and it never showed up, contact the exchange's support team. Give them the transaction hash.

09 · How we traced itMethod and limits

We read every USDT and TRX transfer into and out of the thief's first address. For each wallet that paid it, we read its history back to 2023, and matched each fee top-up to the deposit move that followed it. We then followed the money forward, step by step, until it reached an exchange, a bridge, or a wallet that still holds it. A separate review checked each claim from scratch on a second copy of the data, and its corrections are in this version.

The transfers come from Bitquery's TRON data. The full history is also sold as files on the Bitquery Data Store, as TRON and TRON transfers datasets. Any wallet in this story can be followed with the Bitquery MCP, which lets you ask an AI assistant where a wallet's money went. We traced earlier thefts the same way, including the NGRAVE LIQUID theft and the Bitget hack, and followed a $110M laundering circuit that ran through the biggest exchanges.

10 · The addressesWhere to look

These are the main addresses in this story. All are on TRON.

FAQ

Was CoinDCX hacked in October 2026?

On 21 October a thief took about $16M in USDT from CoinDCX wallets on TRON. CoinDCX says its wallets were not breached and that the drained addresses were old ones it stopped using after July 2025. The record shows the exchange's own system moving deposits through those wallets on the morning of the theft.

How much was stolen from CoinDCX?

About $16 million in USDT, plus a few thousand TRX. Almost all of it came from a single address holding deposits that had never been moved on.

Is CoinDCX safe?

CoinDCX says users' funds are safe and trading continues. The theft hit TRON wallets that the exchange was still using. CoinDCX has not said whether the drained deposits had been credited to the customer who made them.

Where did the stolen USDT go?

About 60% reached deposit addresses at OKX, Binance and Gate within a day. About a quarter went into busy wallets with unknown owners, and $2.28M was still in the thief's wallets at the time of writing.

Were these wallets compromised in the July 2025 CoinDCX hack?

CoinDCX says so. The record shows no theft from them at the time of that hack. The exchange kept moving deposits through them until the day of the theft, and the drained $15.8M sat in one of them for seven months first.

Can Tether freeze the stolen USDT?

Yes. Tether can freeze USDT on any TRON address. At the time of writing it had not frozen any of the wallets that held the stolen USDT.