CoinDCX $16M Hack Claims Challenged by Blockchain Investigators

Blockchain investigators are disputing CoinDCX's explanation for approximately $16 million in suspicious movements from wallet addresses linked to the Indian crypto exchange, alleging the exchange's public account of events does not match on-chain data. CoinDCX, which suffered a separate $44.3 million hack in July 2025 per Halborn's security analysis, says the flagged addresses were already compromised and deprecated before the latest movements occurred. What to Know About the CoinDCX $16M Hack Dispute On October 22, 2026, blockchain investigator Darcy flagged suspicious on-chain movements totalling approximately $16 million from addresses suspected to be associated with CoinDCX, reporting roughly 15.99 million USDT and 5,783.81 TRX in the flagged flows. The assets moved on the TRON network, with the TQKJQ deposit address identified as the focal point of investigator scrutiny. For related coverage, see Blockchain Trading Account Adds Options Trading: What to Know. Investigator-reported suspicious movements $16 million Amount reported by investigators; CoinDCX says the affected addresses were already compromised and deprecated. Three key claims frame the dispute. First, investigators assert the addresses remained operationally active long after the July 2025 incident CoinDCX cited as the point of compromise. Second, CoinDCX says the wallets in question were created in January 2025, compromised in July 2025, and formally deprecated following that security event. Third, the exchange states that user deposit balances were fully credited and that neither active central wallets nor live user addresses were affected. For related coverage, see Best Crypto Casinos for Halloween 2026: Live Events, Spooky Slots, and Real Bonuses. The $16 million figure is an investigator-reported amount, not a number CoinDCX has independently confirmed as a discrete loss total. The exchange's public statement characterizes any shortfall as an operational loss it absorbed internally, not a fresh external hack. For related coverage, see Lighter Review 2026: What the Trading Experience Actually Feels Like. Why Investigators Say CoinDCX's Account Does Not Match the Blockchain Data ZachXBT, the pseudonymous blockchain investigator, alleged that the TQKJQ deposit address remained in active use by a liquidity provider for 10 months after the July 2025 incident, placing $15.8 million in user deposits as unaccounted for in CoinDCX's public reconciliation. That allegation is an investigator claim, not a finding confirmed by CoinDCX or an independent forensic audit. The core analytical discrepancy centers on the timeline: if a wallet was deprecated in July 2025, continued deposits and outflows through late 2026 would indicate either the deprecation was incomplete, the address was re-used, or a third party retained access. CoinDCX's statement acknowledges that deposits continued reaching deprecated addresses and that its regular sweeping process for those post-deprecation deposits failed for a period, resulting in operational losses the exchange absorbed. On-chain evidence on TRON is publicly verifiable, but attributing wallet control to a specific exchange requires more than address association.