CoinDCX Admits $16M Loss After Hack Denial: ZachXBT Urges Withdrawals

CoinDCX has acknowledged approximately $16 million in operational losses after initially denying that it had suffered a new security breach. The disclosure followed suspicious transfers involving wallets linked to the platform and criticism from blockchain investigator ZachXBT, who urged users to withdraw their assets.

CoinDCX maintains that customer funds remain safe and attributes the incident to previously compromised wallet addresses. However, questions about those addresses' subsequent activity have intensified scrutiny of the company's security controls and public disclosures.

Key Takeaways

• Approximately $16 million in losses: CoinDCX says it absorbed the operational losses associated with the incident, while maintaining that affected customer deposits were credited.
• Conflicting accounts of wallet activity: CoinDCX attributes the transfers to addresses compromised in July 2025, but ZachXBT alleges that at least one address continued handling deposits in 2026.
• ZachXBT urges withdrawals: The investigator has publicly advised users to withdraw their assets, although CoinDCX says customer funds remain safe and denies a new breach.

What Happened in the CoinDCX Hack Controversy?

The controversy escalated on 21 October 2026, when approximately $15.99 million in USDT moved from wallets identified by blockchain investigators as being associated with CoinDCX.

The funds were transferred to a separate address on the TRON network before being distributed across additional wallets. The transactions prompted concerns about a possible new security incident, particularly because the amounts involved were substantial.

CoinDCX initially rejected claims that it had experienced another hack. The company said the addresses involved had been compromised during its July 2025 security incident and were no longer in use.

Its subsequent explanation acknowledged approximately $16 million in operational losses. CoinDCX said its processes for handling deposits sent to deprecated addresses had failed for a period, resulting in losses that the company absorbed.

The distinction matters: CoinDCX acknowledged financial losses but disputed the characterisation of the October transactions as a new hack. The company also maintained that affected users had received account credits and that customer assets remained safe.

The central issue is therefore not simply whether funds moved on-chain. It is whether the addresses were genuinely retired, how the transfers occurred, and whether the company's accounting and operational controls adequately protected customer deposits.

Why Did CoinDCX Report $16 Million in Operational Losses?

CoinDCX's explanation centres on deposits sent to old wallet addresses and a failure in the process designed to handle those transactions.

According to the company's statement, the affected addresses had been compromised in July 2025. CoinDCX said they had subsequently been deprecated, meaning users were no longer supposed to send funds to them.

However, some deposits continued to reach these addresses. CoinDCX explained that its operational process was designed to sweep such deposits so they could be accounted for and secured. That process failed for a period, which the company said it identified on the morning of 22 October 2026.

The company said the resulting losses were absorbed through its own resources rather than passed on to customers.

Three questions remain important:

• Why did the addresses continue receiving deposits? The company's explanation raises questions about whether customers were adequately protected against transfers to outdated addresses.
• Why did the recovery process fail? CoinDCX has acknowledged an operational failure, but the publicly available explanation does not establish every detail of how it happened.
• How were the losses reconciled? The company says affected deposits were credited to users, but investigators have questioned the transaction history associated with the addresses.

These questions concern operational security and financial reconciliation, even if the company is correct that no new system breach occurred.

What ZachXBT Alleged About CoinDCX Wallets

ZachXBT challenged CoinDCX's claim that the affected addresses had not been used since the July 2025 incident.

According to his public statements on 22 October 2026, at least one address associated with CoinDCX continued to handle user deposits for months after the earlier incident. He alleged that the address remained active in April and May 2026, moving deposits towards a current public wallet and receiving funds to cover transaction fees.

ZachXBT argued that this activity contradicted the company's explanation that the addresses had been abandoned.

He also questioned why the company initially denied a new security incident before disclosing the operational losses. His criticism focused on transparency, the handling of customer deposits and the reliability of CoinDCX's public statements.

The investigator subsequently urged users to withdraw their assets from the platform.

His warning represents a serious public challenge to CoinDCX's account, but it is important to distinguish an investigator's allegations from independently established conclusions about customer losses or the cause of the transactions.

The dispute also highlights a wider issue in crypto security: an address can be labelled as retired while still appearing in transaction histories. Determining whether the activity was authorised, properly accounted for and adequately disclosed requires more than simply examining the movement of funds.

For readers interested in similar investigations into crypto-related financial risks, Bitrue has also covered the DSJ collapse and ZachXBT's investigation.

Was CoinDCX Hacked Again in October 2026?

As of 23 October 2026, the public statements available do not establish conclusively that CoinDCX suffered a second, new security breach in October.

CoinDCX denied a fresh hack and attributed the transactions to addresses associated with its July 2025 incident. ZachXBT disputed the company's account, citing subsequent wallet activity that he said was inconsistent with its explanation.

The distinction between a new hack and losses associated with previously compromised addresses is significant.

A new hack would suggest another security compromise. By contrast, losses involving old addresses could point to inadequate address management, continued use of compromised infrastructure, failed deposit reconciliation or another operational weakness.

These possibilities have different implications for security controls and customer protection. However, the available statements do not independently establish the complete sequence of events or identify every party responsible.

The earlier incident provides useful context.

On 19 July 2025, CoinDCX reported that an internal operational account used for liquidity provisioning had been compromised following a server breach. The company estimated its exposure at approximately $44 million and said it would absorb the loss using treasury reserves. It also stated that customer assets were held separately and were unaffected.

The October 2026 controversy is different because it centres on allegedly compromised wallet addresses, subsequent transaction activity and the handling of deposits sent to those addresses.

CoinDCX's previous incident report can help explain its security history, but it does not independently resolve the new allegations.

What the $16 Million CoinDCX Incident Means for Users

The immediate concern for users is whether the company can demonstrate that their balances are properly accounted for and that its deposit-handling procedures are functioning as intended.

CoinDCX has said that customer funds remain safe. That assurance is relevant, but users should also pay attention to the evidence supporting it and any subsequent updates about the incident.

Several developments would help clarify the situation.

1. A Detailed Reconciliation of the Transactions

A clear reconciliation should explain the approximately $16 million in transfers, the addresses involved, how the losses were calculated and how affected deposits were credited to customers.

Such a disclosure would help distinguish an operational accounting failure from a broader compromise of customer assets.

2. Evidence of Corrective Measures

Users would benefit from information about how deprecated addresses are disabled or monitored, how unexpected deposits are handled and what changes have been made to prevent similar failures.

An explanation of the corrective measures would also help establish whether the company has addressed the underlying operational weaknesses.

3. Independent Confirmation of Customer Asset Protection

CoinDCX has maintained that customer assets remain safe. Independent evidence supporting its financial position and the reconciliation of affected deposits would help users assess that claim.

Readers should avoid treating either the company's assurance or an investigator's warning as a complete substitute for verifiable evidence.

4. Clear and Consistent Public Communication

The sequence of denial, operational-loss disclosure and criticism over wallet activity has made transparency a central issue.

Timely explanations, documented findings and consistent updates would help users understand what happened without relying solely on competing public statements.

For broader context on crypto security, market risks and project evaluation, readers can also consult Bitrue's guide to crypto projects in India.

How Users Can Reduce Crypto Wallet Risks

The CoinDCX controversy illustrates why users should pay attention to deposit procedures and asset security, rather than relying exclusively on a platform's reputation.

Practical precautions include:

• Verify deposit addresses: Always obtain the latest deposit address through the platform's official interface instead of reusing an old address saved elsewhere.
• Check the blockchain network: Confirm that the selected network matches the intended transfer. Sending assets through an unsupported network can result in losses.
• Start with a small transfer: Where practical, send a small test amount before transferring a larger balance.
• Monitor official incident updates: Review statements explaining what happened, which services were affected and what corrective measures have been taken.
• Understand custody risks: Assets held through a third-party service carry operational and counterparty risks. Consider your security requirements and personal risk tolerance when deciding how to hold them.

Users should also be cautious about unsolicited messages claiming to offer recovery services after a security incident. Never disclose private keys, passwords or recovery phrases to someone promising to restore missing assets.

These measures cannot eliminate every risk, but they can reduce avoidable errors and improve users' ability to respond to unexpected developments.

Conclusion

The CoinDCX controversy has developed into a dispute over more than a $16 million transfer. It raises questions about deprecated wallet addresses, operational controls, deposit reconciliation and the transparency of public communications.

CoinDCX maintains that the incident did not involve a new hack and that customers have not suffered losses. ZachXBT has challenged that explanation and urged users to withdraw their assets.

The key issue now is whether CoinDCX can provide a clear, verifiable account of the transactions and demonstrate that its operational safeguards are adequate. Until the outstanding questions are resolved, users should distinguish confirmed statements from allegations and monitor developments carefully.

FAQ

Did CoinDCX lose $16 million in October 2026?

CoinDCX acknowledged approximately $16 million in operational losses associated with the incident. It denied suffering a new hack and said the losses were absorbed by the company. The precise circumstances remain disputed.

Why did ZachXBT urge users to withdraw from CoinDCX?

ZachXBT questioned the company's explanation that the affected wallet addresses had not been used since July 2025. He alleged that at least one address continued handling deposits in 2026 and criticised the company's initial response to the incident.

Are CoinDCX customer funds safe?

CoinDCX has stated that customer funds remain safe and that affected user deposits were credited. However, the public disagreement over wallet activity means users should assess subsequent disclosures and independently verifiable evidence rather than treating either side's claims as conclusive.

Was CoinDCX hacked in July 2025?

Yes. CoinDCX reported a security incident on 19 July 2025 involving an internal operational account. The company estimated its exposure at approximately $44 million and said the loss would be covered by its treasury reserves.

What should CoinDCX users do after the $16 million incident?

Users should review official incident updates, verify their account balances, use current deposit addresses and follow security guidance. They should also assess their own risk tolerance and avoid sharing credentials or recovery phrases with anyone offering unsolicited assistance.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.