ZachXBT Accuses CoinDCX of Leaving $16 Million in User Funds on Compromised Wallets

A dispute over CoinDCX’s wallet management has turned into a very practical question for any PSP or exchange touching high-risk flow: what happens when a “compromised” address is still in use long after it was supposed to be moved to safety. ZachXBT says the $16 million in question were user deposits left exposed; CoinDCX says the activity was tied to wallets compromised in July 2025, not a fresh attack.

1. Darcy, the marketing director at Salus, flagged suspicious movements from a hot wallet and several deposit addresses that Arkham Intelligence marks as linked to CoinDCX. According to those data, about 15.99 million USDT and 5783.81 TRX were sent on TRON to one address, with the largest single transfer totaling 15.82 million USDT.
2. The recipient then split the assets across several wallets. After that, the funds were moved on to deposit addresses at Binance, OKX, and Gate, which is why ZachXBT treated the pattern as consistent with a hack rather than ordinary treasury movement.
3. CoinDCX chief executive Sumit Gupta said there was no new attack. His version is that the suspicious transactions came from wallets compromised in July 2025, and that attackers were reusing those addresses to make the incident look like a fresh breach.
4. ZachXBT challenged that explanation, saying the compromised addresses had been used by the platform for almost a year, leaving client funds at risk. In his view, the $16 million were user deposits the exchange had not properly accounted for, and the system that should have swept them immediately into safe storage was not working.
5. He also pointed to April and May activity through the same wallet: user deposits were sent to an active public CoinDCX hot wallet, and TRX was sent back from it to cover network fees. ZachXBT urged CoinDCX users to withdraw funds, arguing that the exchange had first denied any theft, then disclosed “operational losses,” while being slow on transparency.

CoinDCX said the mechanism that moves funds from hacked addresses to safe wallets was indeed malfunctioning, that the platform lost money as a result, and that the losses have already been reimbursed. The exchange did not disclose the amount.

The latest dispute sits on top of a bigger wound: in July last year, CoinDCX lost about $44.2 million when hackers drained funds from an internal operational account the exchange used to provide liquidity on a partner platform. The company covered those losses from its own reserves. At the end of July, Indian police detained a CoinDCX employee after investigators said attackers infected his work laptop with malware disguised as tasks for extra income.