Exchange Denies Fresh Breach, But On-Chain Movement Tells a Different Story

Cryptocurrency exchange CoinDCX has publicly addressed recent concerns over unusual on-chain fund transfers. The firm firmly denied experiencing a new security breach or vulnerability, stating that the flagged activity was linked to a wallet historically compromised back in July 2025. CoinDCX emphasized that these addresses are not connected to its current operational infrastructure.

Analyst Counters: Why Was the Wallet Still Active?

However, prominent on-chain investigator ZachXBT challenged this narrative. His analysis revealed that the deposit address TQKJQ, which CoinDCX labeled as a "historically breached" wallet, was not deactivated immediately after the 2025 incident. According to the data, liquidity providers continued using this address for approximately 10 months. As recently as April and May 2026, it was still receiving user deposits and gas fees, and had transferred funds to CoinDCX's currently listed hot wallet.

This finding raises a critical question: If the address was known to be compromised, why did it remain part of the operational flow for nearly a year? ZachXBT pointed out that CoinDCX's statement fails to adequately account for the final destination of an estimated $15.8 million in user deposits that flowed through this address during that period.

The Massive Transfer: Tracing 15.99 Million USDT

The controversy stems from a specific on-chain event. Records show that in the early hours of yesterday, a CoinDCX hot wallet, along with several deposit addresses, sent approximately 15.99 million USDT and 5,783.81 TRX to a single address on the TRON network. The largest single transaction was 15.819 million USDT. The receiving address promptly split and rerouted these funds through multiple transactions to deposit addresses of major exchanges including Binance, OKX, and Gate.

  • Core Issue 1: The actual separation between the "historically breached address" and current operations.
  • Core Issue 2: The safekeeping and handling of user funds that entered via this address post-July 2025.
  • Core Issue 3: The purpose and compliance of this large-scale fund movement.

As of now, CoinDCX has not provided a more detailed response to ZachXBT's follow-up questions. This incident underscores that fund transparency and user asset security remain critical areas where crypto exchanges must continually prove their integrity. The community awaits a more comprehensive on-chain audit and a full explanation from the exchange.