CoinDCX 2026: 15.8 million USDT left an old CoinDCX deposit address compromised in July 2025
Old CoinDCX deposit address sends out 15.8M USDT
A Tron address that CoinDCX says it retired after its July 2025 hack sent 15,819,002 USDT to a new wallet on 21 October 2026. CoinDCX denies a new breach, says a sweep of deposits to old addresses failed for a period, and says it absorbed the losses.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
At 15:35 UTC on 21 October 2026, a Tron address that CoinDCX says it stopped using after its July 2025 hack sent 15,819,002 USDT to a new wallet. That wallet passed the money on within 12 hours. CoinDCX, an Indian exchange on the register, denies a new breach. It says a routine sweep of deposits that users kept sending to old addresses failed for a period, and that it absorbed the losses.
What the document says
The primary record here is the Tron blockchain, read on Tronscan on 24 October 2026. The sending address is TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy. Before 21 October, its last USDT movement was on 4 May 2026.
Users’ funds are safe. ✅ Claims circulating on X regarding certain wallet addresses and transactions are misleading. The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not…
The receiving address, TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, made its first USDT transfer at 12:33 UTC that day. Between then and 00:52 UTC on 22 October it received 46 USDT transfers worth 15,991,414.31 USDT. One was the 15,819,002 USDT transfer; the other 45 came from 40 other addresses. By 03:22 UTC on 22 October it had sent the full amount out again in 18 transfers to six addresses. Its USDT balance is now zero.
CoinDCX's explanation was given to reporters and on X. A spokesperson told CoinDesk:
These addresses were compromised in July 2025 and have not been used by CoinDCX since.
According to Unchained, CoinDCX's later update on X said the sweep had "failed" for "a particular period" and that this "led to some operational losses, which were absorbed by CoinDCX." The company has not published the amount or the number of users affected.
What it changes for users
CoinDCX says affected users' accounts were credited, that customer assets sit in cold wallets, and that its current central and user addresses were not affected. These are the company's statements and were not checked against an independent source for this piece.
Further update on the TQKJQ wallet On-Chain activity. Following the July 2025 security incident, we advised users not to deposit crypto to the compromised wallet addresses. These addresses were generated earlier in 2025, were compromised during the incident, and have since been…
Part of the money is now frozen. Tether's USDT contract on Tron marks four addresses linked to this flow as blacklisted. One, TVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6L, received 20,000 USDT directly from the receiving wallet. The other three sit four to five transfers further down, after the money was mixed with other funds. On 24 October the four held 20,000, 400,994.82, 319,000 and 664,939.48 USDT, or 1,404,934.29 USDT in total. Blockchain analytics firm AMLBot, as reported by The Crypto Times, said Tether froze about $2.2 million in USDT tied to the outflow. That figure was not verified here.
On-chain investigator ZachXBT alleged on X, as reported by CoinDesk, that TQKJQ was used by a liquidity provider for 10 months after the July 2025 incident. That is an allegation, and CoinDCX has not confirmed it. Tronscan does show transfers of 200,000 to 350,000 USDT through the address in late April and early May 2026.
CoinDCX also told users, according to Unchained, to "always verify updated deposit addresses from the CoinDCX App or website." An address saved before the July 2025 incident is the kind this one turned on.
Background
CoinDCX's own July 2025 incident report says an internal operational account was compromised and about $44 million was taken, and that no customer assets were affected. The CoinDCX register entry records that report as a company statement. How Tether freezes work is covered in the What is USDT? guide.
Quick answers
Was CoinDCX hacked again in October 2026?
CoinDCX says no. It says the address was compromised in July 2025 and that a failed sweep of deposits to retired addresses caused operational losses. ZachXBT disputes parts of that account, according to CoinDesk and Unchained.
How much USDT left the old CoinDCX address?
15,819,002 USDT in one transfer on 21 October 2026, according to Tronscan. The receiving wallet took in 15,991,414.31 USDT in total and sent it all on.
Did CoinDCX users lose money?
CoinDCX says it credited affected users and absorbed the losses. It has not said how much that was, and the claim was not independently checked.
Sources
- Tronscan, USDT transfer of 15,819,002 USDT from TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy, 21 October 2026, retrieved 24 October 2026
- Tronscan, USDT transfers of address TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, retrieved 24 October 2026
- Tronscan, USDT transfers of address TQKJQrWok6fsBqZi3mkLkL6qX4YEgjqWUy, retrieved 24 October 2026
- Tether USDT contract on Tron, isBlackListed and balanceOf read for TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG, TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs and TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a, retrieved 24 October 2026
- CoinDesk, CoinDCX denies hack, blames broken clean up job for 16 million dollar outflow, 23 October 2026, retrieved 24 October 2026
- Unchained, CoinDCX absorbs losses, credits users after failed sweep of hacked deposit addresses, 23 October 2026, retrieved 24 October 2026
- The Crypto Times, Tether freezes 2.2 million dollars of USDT tied to the CoinDCX outflow, 23 October 2026, retrieved 24 October 2026
- CoinDCX, incident report, 19 July 2025, retrieved 9 October 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.