CoinDCX loses 15.99M USDT from a retired TRON wallet compromised in its 2025 hack
CoinDCX exchange (deprecated TRON deposit wallet)
On Oct 21 2026 about 15.99 million USDT plus some TRX moved out of CoinDCX-linked TRON addresses to a single address that split the funds. India's largest exchange first called reports a false alarm, then said on Oct 25 that the loss came from TQKJQ, an old operational wallet compromised in its July 2025 hack and deprecated afterwards: users kept depositing there, CoinDCX credited them, and the service that sweeps those deposits into its main wallets had failed for a period, so funds piled up in the exposed address. CoinDCX says it absorbed the loss and that customer balances, active wallets and trading were unaffected. It has not said who moved the funds or how.
Why this severity: About $16M lost by the exchange; CoinDCX says customer balances were not affected
- Started
- Oct 21, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
CoinDCX confirms a 15.99M USDT loss from deprecated wallet TQKJQ after its deposit-sweeping service failed for a period, and says it absorbed the loss.
CoinDCX denies its active wallets were hacked, saying the addresses were compromised in July 2025 and unused since; ZachXBT says one of them, TQKJQ, still swept deposits to CoinDCX's current hot wallet in April and May 2026.
About 15.99M USDT and some TRX flow out of a CoinDCX hot wallet and several deposit addresses to one TRON address, which then splits the funds; an X user, Darcy, flags it.
Advisories1
News & write-ups3
- CoinDCX denies hack, blames broken clean up job for $16 million outflowCoinDesk · Oct 23, 2026
- CoinDCX absorbs $16 million loss from internal process failure tied to retired walletCoinDesk · Oct 26, 2026
- CoinDCX confirms functioning of rogue wallets, siphoning user funds worth $16 millionThe Hindu BusinessLine
Notes & caveats
CoinDCX's post does not call it a hack or say who moved the funds or how. The July 2025 incident cost about $44M (CoinDesk).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
