News linked to both this project and an event.
CoinDCX has issued an announcement stating that it detected anomalous system activity on October 21, and subsequent investigation confirmed that the anomalous activity affected legacy wallet infrastructure that had been deprecated following the July 2025 security incident. CoinDCX stated that due to a malfunction in the automated fund sweeping service that lasted for a period of time, some user deposits mistakenly sent to old addresses were not transferred in a timely manner, ultimately resulting in a loss of 15.99 million USDT, with the related losses borne by the company.CoinDCX emphasized that existing wallets and trading systems were unaffected, user funds remain securely held in isolated cold wallets, and trading, deposit, and withdrawal services all continue to operate normally.
According to monitoring by Salus, Tether has blacklisted nine addresses linked to the CoinDCX security incident and frozen approximately 2.2129 million USDT. The investigation was triggered by an anomalous transfer, and subsequent on-chain evidence prompted Tether to implement the freeze.
Onchain Lens posted on X questioning CoinDCX's so-called hack incident, stating that CoinDCX may have undisclosed fund anomalies—user deposits had flowed into a wallet that was not included in the relevant fund accounting, after which nearly equivalent funds were transferred out; some funds were also moved through less common cross-chain bridge entry points and services, indicating abnormal pathways.Onchain Lens further pointed out that some funds suspected to be related to CoinDCX hot wallets flowed through over-the-counter (OTC) services and mixing platforms, and questioned that the CoinDCX team still denied the occurrence of a security incident even after multiple researchers and on-chain investigators presented relevant evidence.
CoinDCX stated that recent claims on platform X regarding certain wallet addresses and transactions are misleading. The related transactions involve legacy wallet addresses created in January 2025 and compromised in July of the same year, which the platform ceased using thereafter. It asserted that recent on-chain activity is unrelated to its operations and that user funds remain secure. In response, on-chain investigator ZachXBT countered that CoinDCX's deposit address TQKJQ remained in use by liquidity providers for approximately 10 months following the July 2025 incident. These addresses continued to receive user deposits and gas fees in April and May 2026, subsequently transferring the funds to CoinDCX's currently disclosed hot wallet. He raised questions over how the CoinDCX team failed to account for the whereabouts of approximately $15.8 million in user deposits.