# CoinDCX loses 15.99M USDT from a retired TRON wallet compromised in its 2025 hack · pwn.watch > On Oct 21 2026 about 15.99 million USDT plus some TRX moved out of CoinDCX-linked TRON addresses to a single address that split the funds. India's largest exchange first called reports a false alarm, then said on Oct 25 that the loss came from TQKJQ, an old operational wallet compromised in its July 2025 hack and deprecated afterwards: users kept depositing there, CoinDCX credited them, and the service that sweeps those deposits into its main wallets had failed for a period, so funds piled up in the exposed address. CoinDCX says it absorbed the loss and that customer balances, active wallets and trading were unaffected. It has not said who moved the funds or how. Page: https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026 · generated 2026-10-26T16:03:32.143Z ## Status - Severity: medium · status: live · patch: no-fix-needed - Product: CoinDCX exchange (deprecated TRON deposit wallet) - Started: 2026-10-21 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026.json - This file: https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026/llms.txt ## Updates (newest first) - 2026-10-25: CoinDCX confirms a 15.99M USDT loss from deprecated wallet TQKJQ after its deposit-sweeping service failed for a period, and says it absorbed the loss. (https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026) - 2026-10-23: CoinDCX denies its active wallets were hacked, saying the addresses were compromised in July 2025 and unused since; ZachXBT says one of them, TQKJQ, still swept deposits to CoinDCX's current hot wallet in April and May 2026. (https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows) - 2026-10-21: About 15.99M USDT and some TRX flow out of a CoinDCX hot wallet and several deposit addresses to one TRON address, which then splits the funds; an X user, Darcy, flags it. (https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows) ## Fix brief # Security brief: CoinDCX loses 15.99M USDT from a retired TRON wallet compromised in its 2025 hack Source: https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026 · status: live · severity: medium · updated Oct 26, 2026, 13:20 UTC ## Patch status **NO FIX NEEDED: no action on your side beyond verification.** ## What it is On Oct 21 2026 about 15.99 million USDT plus some TRX moved out of CoinDCX-linked TRON addresses to a single address that split the funds. India's largest exchange first called reports a false alarm, then said on Oct 25 that the loss came from TQKJQ, an old operational wallet compromised in its July 2025 hack and deprecated afterwards: users kept depositing there, CoinDCX credited them, and the service that sweeps those deposits into its main wallets had failed for a period, so funds piled up in the exposed address. CoinDCX says it absorbed the loss and that customer balances, active wallets and trading were unaffected. It has not said who moved the funds or how. Severity detail: About $16M lost by the exchange; CoinDCX says customer balances were not affected - Product: CoinDCX exchange (deprecated TRON deposit wallet) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Specific notes CoinDCX users: always copy the current deposit address from the CoinDCX app or website before each deposit and never reuse old saved addresses. CoinDCX says balances were credited and are unaffected. ## Latest updates - Oct 25, 2026: CoinDCX confirms a 15.99M USDT loss from deprecated wallet TQKJQ after its deposit-sweeping service failed for a period, and says it absorbed the loss. - Oct 23, 2026: CoinDCX denies its active wallets were hacked, saying the addresses were compromised in July 2025 and unused since; ZachXBT says one of them, TQKJQ, still swept deposits to CoinDCX's current hot wallet in April and May 2026. - Oct 21, 2026: About 15.99M USDT and some TRX flow out of a CoinDCX hot wallet and several deposit addresses to one TRON address, which then splits the funds; an X user, Darcy, flags it. ## Advisories - [Update on the on-chain Wallet Activity - 21st October 2026](https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026) (CoinDCX) ## Write-ups & news - [CoinDCX denies hack, blames broken clean up job for $16 million outflow](https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows) - [CoinDCX absorbs $16 million loss from internal process failure tied to retired wallet](https://www.coindesk.com/markets/2026/10/26/coindcx-absorbs-usd16-million-loss-from-internal-process-failure-tied-to-retired-wallet) - [CoinDCX confirms functioning of rogue wallets, siphoning user funds worth $16 million](https://www.thehindubusinessline.com/money-and-banking/cryptocurrency/coindcx-confirms-functioning-of-rogue-wallets-siphoning-user-funds-worth-16-million/article71612582.ece) ## Caveats CoinDCX's post does not call it a hack or say who moved the funds or how. The July 2025 incident cost about $44M (CoinDesk). --- Machine-readable: https://pwn.watch/i/coindcx-deprecated-tron-wallet-16m-loss-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.