CoinDCX deprecated TRON deposit wallets hack — October 2026

On 21 October 2026 about 15.99 million USDT left 40 TRON wallets belonging to CoinDCX, one of India’s largest crypto exchanges, and went to a single new address. According to Bitquery, which read every wallet involved, $15.82 million of it came from one deposit address where 88 deposits from a single depositor had sat unmoved since March, and the thief’s first move came at 12:19 UTC, five minutes after the exchange’s own system had last moved funds through one of the wallets. Within about a day $9.63 million had reached deposit addresses at OKX, Binance and Gate.

CoinDCX first denied a breach. On 22 October co-founder Sumit Gupta called the reports a false alarm, saying the addresses had been generated in January 2025, compromised in the exchange’s July 2025 hack and not used since. Later that day the exchange said its process for sweeping deposits that users kept sending to those deprecated addresses had failed for a period, that the resulting losses were absorbed by CoinDCX and that every affected deposit was credited to users. Bitquery and the investigator ZachXBT disputed the “old addresses” account, pointing to customer deposits and fee top-ups moving through the drained wallets in 2026. On 27 October Gupta wrote that dismissing the incident as a false alarm had been his mistake and repeated that CoinDCX had absorbed all losses.

Tether froze $2.21 million of the stolen USDT in nine wallets late on 22 October, which this registry counts as recovered. How the keys were obtained has not been explained, and nobody has been named. This is CoinDCX’s second loss in this registry after the July 2025 hack.