India Crypto Exchange Denies Hack After $16M Outflows

What Triggered the $16 Million Outflow Concerns

The alert originated with on-chain investigator Darcy, who publicly flagged approximately 15,819,002 USDT and 5,783.81 TRX moving to a single TRON address — TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT — in what appeared to be a coordinated sweep of funds connected to CoinDCX wallets. For related coverage, see AI Revolution Summit – India 2026.

The report spread quickly across crypto social channels, drawing attention from well-known on-chain investigator ZachXBT, who raised a pointed challenge to CoinDCX’s initial explanations. According to ZachXBT, the abbreviated deposit address in question — ending in TQKJQ — was used by a liquidity provider for roughly 10 months after the July 2025 incident, continued to sweep user deposits, and received gas funding as recently as April and May 2026. That claim, if accurate, would undercut the exchange’s characterization of the wallets as purely historical artifacts. The underlying TRON transaction trail could not be independently verified through a block explorer in this reporting run. For related coverage, see World Datacentre Summit India 2026 Opens Sponsorship, Speaking, and Exhibition Opportunities.

The episode landed in an already sensitized environment for Indian crypto. The country’s exchange sector has drawn growing institutional and regulatory attention, with competitive activity picking up as evidenced by initiatives like the Coinbase India trading competition offering a 33 million INR prize pool — a sign that major platforms are competing intensely for the same user base CoinDCX has historically dominated. For related coverage, see House Panel Advances Crypto Tax Bill Limiting Some Loss Write-Offs.

CoinDCX’s Explanation: Deprecated Wallets, Not a New Breach

CoinDCX moved quickly to contain the narrative. Co-founder Sumit Gupta was among the first to respond publicly, directly refuting the breach framing. For related coverage, see Licovia Crypto Cards Make Digital Assets Spendable.

Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.

The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the… https://t.co/6hKfTtffHK

— Sumit Gupta (@smtgpt) October 22, 2026

Source: @smtgpt on X

The exchange followed with a more detailed official statement explaining its position. CoinDCX said the wallet addresses flagged by investigators were generated in early 2025, compromised during the July 2025 security incident, and subsequently deprecated. The exchange acknowledged that its automated sweep process for deposits made to those deprecated addresses failed during a specific period, generating operational losses that the company absorbed internally.

Critically, CoinDCX said affected user deposit wallets were credited regardless of whether the underlying sweep functioned correctly, and stated that active central and user-facing addresses were not impacted. In other words, the exchange framed the event as an internal operational failure rather than a second external breach — admitting a sweep-process malfunction while denying any new compromise of live infrastructure.

The Outstanding Conflict

The distinction between CoinDCX’s position and ZachXBT’s on-chain analysis matters significantly. CoinDCX characterizes the flagged addresses as fully deprecated relics of the 2025 hack. ZachXBT’s findings, based on blockchain data this outlet could not independently replicate, suggest at least one of those addresses remained operationally active well into 2026. These two accounts cannot both be correct, and the exchange has not publicly addressed the specific activity timeline the investigator cited.

CoinDesk’s reporting on the incident noted CoinDCX obtained a spokesperson response confirming the deprecated-address explanation, but the publication did not print the destination wallet address identified by Darcy. The specific TRON destination — TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT — has not been addressed directly in CoinDCX’s public communications.

What This Means for Users and the Broader Indian Crypto Market

CoinDCX’s statement that customer assets remain safe in segregated cold wallets and that all affected deposit accounts were credited is a company assertion rather than an independently verified fact at this stage. Users should treat official exchange updates as the primary source of information while independently confirming account balances through their own dashboard activity.

The broader market context is worth noting. Bitcoin was trading at $81,627 at the time of this report, down roughly 0.24% over 24 hours, while the Crypto Fear & Greed Index sat at 50, registering Neutral sentiment. That measured backdrop means the CoinDCX story is unfolding in a market that is neither in full-risk-on mode nor acute distress, which may limit contagion effects on broader Indian crypto sentiment if the exchange’s account holds up under further scrutiny.

The July 2025 CoinDCX exploit, which totaled approximately $44 million and involved an internal account used for liquidity operations with a partner exchange, already forced a significant operational restructuring at the firm. A second confirmed incident would be a severe reputational blow for a platform that positions itself as India’s leading gateway to digital assets, particularly as the country’s regulatory environment continues to evolve. Developments like the House panel’s advancement of a crypto tax bill illustrate how quickly policy frameworks are moving in ways that could directly affect how Indian exchanges report and disclose security events.

Facts Still to Be Confirmed

Three material questions remain unresolved. First, whether the TQKJQ address was genuinely inactive prior to the observed outflows, or remained live for operational use after the July 2025 deprecation CoinDCX describes. Second, whether the sweep-process failure CoinDCX admits to was isolated to the specific period it cites, or involved a longer window of unrecovered deposits. Third, the total operational loss CoinDCX says it absorbed has not been quantified in any public filing or exchange disclosure.

India’s crypto sector is drawing increasing attention from both builders and investors, with events like the AI Revolution Summit India 2026 and major infrastructure conferences signaling that the country’s digital asset ecosystem is scaling rapidly. Security incidents at its largest exchange — confirmed or disputed — carry outsized weight for institutional confidence in that growth story. Until CoinDCX addresses the specific post-deprecation activity timeline identified by on-chain investigators, the gap between its account and what the blockchain data appears to show remains an open question.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.