CoinDCX's $16M Wallet Mystery: Hack or Cleanup?

Late on October 21, Asia time, money started leaving a cluster of TRON wallets tied to CoinDCX, India's largest cryptocurrency exchange. Roughly 15.99 million USDT and 5,783.81 TRX converged on a single address, the largest transfer alone about 15.82 million USDT. That address then split the funds across new wallets, round after round, until they landed in deposit addresses at several other exchanges. On October 22, the chief marketing officer of a blockchain security firm flagged the outflow on X as a suspected theft, and "did CoinDCX just get hacked" spread across crypto social media within hours. CoinDCX was pushing back before most of its users had seen the question asked.

A CoinDCX Hack, Denied Within Hours

CoinDCX's answer arrived fast, and it was a flat no. Co-founder Sumit Gupta replied to the alert less than three hours after it went up. The flagged addresses were old, he said: the exchange generated them in January 2025, attackers compromised them in its July 2025 breach, and the exchange had not used them since. He added that the team had checked every current central and user address and none had sent funds to the flagged ones. For a company that had already absorbed a loss of about $44 million the year before, the message was meant to close the story on day one: this is old wreckage, not a new fire.

It did not close the story. As CoinDesk's reporting on the dispute lays out, the researchers who flagged the transfers kept watching the same wallets, and what they found next did not fit neatly with "old and untouched."

Then a Second Admission, a Day Later

Within a day, CoinDCX changed the shape of its own explanation. The exchange acknowledged a separate, internal problem: the process it uses to sweep deposits out of retired wallet addresses had failed for a period, causing what it called operational losses. Some users, it said, had kept sending funds to those deprecated addresses despite earlier notices. CoinDCX said it had credited every affected user and absorbed the loss itself, but it did not disclose how large that loss was or how long the failed process ran. That is two different stories inside roughly 24 hours from the same company about the same cluster of wallets: first, "these addresses are dead and this isn't us," then, "there was a real internal failure, and we already covered it."

Independent researchers were not satisfied that the two statements fully squared with the on-chain record. On-chain investigator ZachXBT said one of the flagged deposit addresses was used by a liquidity provider for ten months after the July 2025 incident and swept user deposits into CoinDCX's current public hot wallet as recently as April and May 2026. He also alleged that about $15.8 million in user deposits went unaccounted for. Blockchain data firm Bitquery published its own review of the TRON record: the drained hot wallet kept sending small TRX fee top-ups to deposit addresses after the 2025 hack, 276 of them from August through the morning of the theft, each followed by a deposit move. That is hard to square with addresses nobody had touched in over a year.

What Nobody Actually Disputes

Strip out the back-and-forth and one fact holds regardless of which explanation is right: roughly $16 million moved out of wallets connected to a major exchange, along a path anyone with a block explorer could trace, and the exchange's own account of why changed once outside researchers started asking questions in public. Whether that is a quietly handled operational bug, a 2025 intrusion still draining, or something closer to a fresh compromise is still unresolved as of this writing. CoinDCX says customer assets sit in cold wallets, its current addresses were not hit, and trading continues as usual.

The Same Company's Earlier Answer Was Self-Custody

This is not the first time CoinDCX has had to answer a custody question in public. In October 2024, months after a rival Indian exchange lost more than $230 million in a wallet breach, CoinDCX launched what it called a decentralized custody option, letting users move holdings out of the exchange's custody into an on-chain wallet they control. The idea was sound: the less of your money sits inside a system you can't see into, the less a breach of that system can cost you.

The problem this new dispute exposes is narrower but just as real. Self-custody protects the coins a user chooses to hold themselves. It says nothing about the deposit pipes, retired-address sweep jobs and internal wallet management an exchange still runs behind the scenes, on money that passes through it. A user can do everything right and still be left reading a statement that changes overnight, because the part they can't see is the part that moved.

Where NexusPool Solves a Related, Different Problem

NexusPool is built for a different piece of the custody question, specifically the moment a miner's block reward exists at all. The block pays your address. There is no balance for us to hold. That isn't a policy choice NexusPool could reverse under pressure; it's how the coinbase transaction is built, so there's no pooled wallet to misreport, retire, or quietly sweep later. Payout Preflight shows a miner the exact coinbase transaction that would pay their address on the current block, before any block is found, which is the opposite of a statement issued after money has already moved.

The other half is the accounting problem CoinDCX's dispute turns on: whose numbers do you believe when a company's own explanation shifts? NexusPool's answer there is its Glass Ledger: each hour, a signed receipt for the work we counted, using BIP340 signatures against a key NexusPool publishes. A miner can check that receipt with their own code against the published key, rather than waiting on a statement that might change by the next news cycle. More on how both pieces fit together sits on NexusPool's technology page.

None of that has anything to do with TRON wallets, retired-address sweep jobs, or whether CoinDCX's account of October 21 holds up. It's the same underlying habit, applied to a different product solving a different problem: build the claim so it can be checked on its own, not accepted because a company said so first and explained later.

Back at the Wallet

The researchers who flagged the October 21 transfers are still watching the same cluster of addresses. The $16 million question CoinDCX now faces isn't really about whether its explanation sounds plausible; plausible explanations are cheap after the fact. It's about whether the next person watching a wallet like this one has to wait for a company's statement at all, or can simply look. For CoinDCX's users right now, the honest answer is: they're still waiting.

This post does not confirm whether CoinDCX was hacked and takes no position on claims that remain disputed between the exchange and outside investigators. It makes no promise about mining rewards, and no suggestion that a signed receipt or a payout preview would have resolved an exchange's internal wallet dispute.

Trust nothing. Verify where a transfer actually goes, not just what a company calls it.