Mentioned in This Article
1. What did CoinDCX announce about the failed sweep?
CoinDCX, the Indian crypto exchange, said on October 22 that customers who kept sending funds to deposit addresses it retired after its July 2025 hack have been credited, and that the company is absorbing the resulting losses itself. The exchange attributed the problem to a routine sweep of those deposits that broke down for a period, and it did not publish a loss figure.
The statement, posted on the exchange's account on X, followed a day of conflicting messages about unusual movements on a group of old addresses. It closes one question for affected depositors, who are being made whole, while leaving several others open: how long the sweep was down, how many users were touched and how large the shortfall really was.
In practical terms, the exchange is telling customers that nobody who sent money to an old address will bear a loss. The cost, whatever it is, lands on CoinDCX's own balance sheet. That is a notable commitment for a platform still living with the consequences of a theft that took roughly $44 million from one of its internal accounts.
2. How the July 2025 hack left old addresses behind
The background to the dispute is the breach of July 2025, when attackers drained about $44 million from an internal CoinDCX account. After an incident of that kind, an exchange typically abandons the wallet infrastructure that was exposed and issues fresh deposit addresses, because any key or system the intruders touched can no longer be trusted.
CoinDCX says it told users to stop depositing to the compromised addresses. Habits are hard to change, however. Customers save deposit addresses in wallet apps, in address books and in automated payment instructions, and funds sometimes keep arriving at a destination long after a platform has stopped monitoring it.
For that reason the exchange had arranged for anything still landing on the deprecated addresses to be swept routinely, meaning moved on a schedule into wallets the company controlled so it could be secured. This is the process that, by the exchange's own account, failed for a period and produced what it describes as operational losses.
A deposit sweep is ordinary housekeeping at most exchanges. Customer deposits arrive at many individual addresses, and a back-end process consolidates them into a smaller number of wallets. When that process fails, funds can sit exposed on addresses that are no longer closely guarded, which is why a lapse on addresses already tied to a hack draws particular attention.
Exchanges rely on this design for both efficiency and safety. Giving each customer a unique deposit address makes it easy to match incoming funds to an account, but it also multiplies the number of places where money can sit. Sweeping consolidates those balances so that most value is held in a small set of well-protected wallets, with only working funds kept online.
The same logic explains why retiring an address is not a single step. Closing off an old address in the app does nothing to stop someone from sending funds to it, because blockchains do not check whether a platform still wants a deposit. Unless the exchange keeps watching and sweeping, those funds can stay put or be taken by whoever holds the relevant keys.
3. What the exchange has said it will cover
CoinDCX said it identified the breakdown on Thursday morning, India time, and that it has credited users whose deposits went to the deprecated addresses. It stated that it bore the losses from the failed sweep rather than passing them on to customers.
The announcement leaves out the details that would let outsiders judge the scale of the problem. The exchange did not say how long the sweep was down, how many users were affected or what the total loss amounted to. It also did not say whether a large Tether transfer observed on the Tron network earlier in the week formed part of those losses.
Crediting users is the clearest signal of intent, but it does not by itself establish how the failure occurred. Whether the sweep stalled because of a technical fault, a configuration change or a security issue is not stated in the exchange's account.
For customers, the more immediate point is that the credit protects the balance shown in their account. For the exchange, the cost of covering losses from its own operational lapse is a test of its financial resilience, and it reflects the reputational pressure an exchange faces after a security incident.
4. A transfer of 15.8 million USDT on the Tron network
Blockchain records show that an address beginning TQKJQ on the Tron network moved 15,819,002 USDT at 11:35 a.m. Eastern time on Wednesday, October 21. The recipient was a wallet created roughly three hours earlier. By 11:22 p.m. Eastern that night, that new wallet had forwarded all of the USDT it received onward.
USDT is the dollar-pegged stablecoin issued by Tether, and Tron is one of the most widely used networks for moving it. Who controls the receiving wallet is unknown. The transfer drew attention because it came from an address linked to CoinDCX's old infrastructure.
CoinDCX's Thursday post was framed as a further update on activity involving the TQKJQ wallet. Even so, it supplied no loss figure and did not tie the 15.8 million USDT movement to the sweep failure, so the relationship between the two remains unconfirmed.
5. Conflicting posts through Thursday
Earlier on Thursday, CoinDCX co-founder Sumit Gupta denied that a new breach had taken place. He said the flagged addresses dated back to January 2025 and were the ones that fell into the hands of hackers in July, and he suggested the attackers were reusing old addresses. He called the alert a probable false alarm.
The exchange's own post at the time went in the same direction, saying the addresses had not been used by CoinDCX since the hack. That statement sits uneasily alongside the later admission that deposits had still been arriving on deprecated addresses and that a sweep of them had failed.
The two positions are not necessarily incompatible. An exchange can say it no longer issues an address to customers while still monitoring it for stray deposits. But the sequence, a denial followed by an acknowledgement of losses within the same day, is likely to leave users wanting a fuller explanation.
Communication during an incident is often as important as the technical response. When on-chain sleuths publish findings in real time, an exchange has to decide quickly whether to confirm, deny or stay silent, and an early denial that later needs revising can cost credibility even when the underlying facts are still being established.
6. What did on-chain investigator ZachXBT allege?
The independent on-chain investigator ZachXBT alleged that TQKJQ was still sweeping user deposits in April and May 2026 into the hot wallet that CoinDCX currently uses. A hot wallet is an internet-connected wallet used for day-to-day withdrawals and operations. He claimed that $15.8 million in user deposits was unaccounted for.
CoinDCX has not confirmed that figure. Gupta responded that the team was investigating and assured users that no user funds would be lost. That pledge matches the later decision to credit affected customers.
The chain history adds some context. TQKJQ's first recorded activity was on March 27, 2025, and incoming USDT transfers to it continued until May 4, 2026. That timeline means the address stayed in use for well over a year after the January 2025 date Gupta gave for the flagged addresses and for roughly ten months after the July 2025 hack.
7. Are customer assets safe at CoinDCX?
CoinDCX says customer assets are held in segregated cold wallets, which are kept offline, and that the central addresses and user addresses it currently uses were not affected. If accurate, the problem is confined to retired infrastructure rather than the wallets that hold present balances.
The distinction matters for ordinary users. Funds held in the current system are, on the exchange's account, untouched, while the exposure relates to money sent to addresses that should no longer have been in use. The exchange has offered no independent proof of reserves in this statement, so the claim rests on the company's word for now.
Users who sent deposits to the old addresses have been told they are being credited. Those who followed the exchange's guidance and use only current addresses are not described as being affected by the incident.
8. What should users do now?
CoinDCX told customers not to deposit to deprecated addresses and to confirm every deposit address through the official app or website before sending funds. Checking the address each time, rather than relying on a saved entry, is the simplest protection against both stale addresses and lookalike scams.
The exchange also reminded users that platforms typically do not accept liability for deposits sent to wrong addresses. That is standard in the industry, and it makes the current crediting a goodwill measure rather than a guaranteed entitlement. CoinDCX has not said whether it will keep crediting deposits sent to the old addresses in the future.
The open items are the exchange's loss figure, the length of the sweep outage, the status of the 15.8 million USDT transfer and its answer to the allegation of unaccounted deposits. Until CoinDCX publishes those details, users and observers have only partial answers about an incident that reaches back to the 2025 breach.
For a market that has seen repeated exchange breaches, the episode underlines how long the tail of a hack can be. Security work does not end when stolen funds are accounted for; it extends to every address, key and process that was ever exposed, and to the habits of customers who continue to use them. How CoinDCX closes the remaining gaps will shape whether users regard the exchange as having fully recovered from 2025.