On-chain investigator ZachXBT has raised fresh questions about the Indian cryptocurrency exchange CoinDCX, asserting that a deposit address previously linked to a 2025 security incident remained active for months afterward and continued handling user funds.
In a post on X dated October 22, 2026, ZachXBT stated that the TRON-based deposit address beginning with TQKJQ was still being utilized by a liquidity provider for roughly ten months following the July 2025 compromise.
According to the investigator, the address continued to receive and sweep user deposits, along with gas fees, as recently as April and May 2026, with those funds moving to wallets publicly identified as CoinDCX’s current hot wallets.
ZachXBT argued that this activity indicates approximately $15.8 million in user deposits was not properly accounted for by the exchange team.
He accompanied the claim with a screenshot from Arkham Intelligence showing transaction history, including a large outflow of 15.819 million USDT from the TQKJQ address on October 21, 2026, as well as multiple smaller transfers of USDT and TRX involving the same deposit address and CoinDCX hot wallets in May 2026.
In the post, ZachXBT also questioned the broader trustworthiness of Indian centralized exchanges, referencing earlier incidents at platforms such as WazirX and BitBNS.
CoinDCX had earlier responded to circulating claims about certain wallet addresses and transactions.
The exchange stated that users’ funds remain safe and that the relevant addresses were created in January 2025, compromised during the July 2025 incident, and had not been used by CoinDCX since that time.
CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.
Meaning $15.8M in user deposits was unaccounted for by your team.
Why are Indian… pic.twitter.com/S8WYtGNIjz
— ZachXBT (@zachxbt) October 22, 2026
The platform described the recent reported activity as unrelated to its operations and tied only to those older, compromised addresses.
Trading and investing services were said to continue normally, with the company directing users to rely solely on official channels for updates.
In a subsequent reply, CoinDCX co-founder Sumit Gupta acknowledged awareness of the specific points raised by ZachXBT.
Gupta indicated that the team was investigating the matter further and would share an update soon.
He reiterated an assurance that no user funds would be lost as a result.
The July 2025 incident itself involved the compromise of an internal operational account used for liquidity provisioning on a partner exchange.
At the time, CoinDCX confirmed that roughly $44 million was lost from that segregated account, while maintaining that customer assets held in cold storage were unaffected and that the loss would be absorbed from the company’s own treasury reserves.
The breach was initially flagged by ZachXBT and security firms after funds were bridged across chains, and the exchange publicly addressed it roughly 17 hours later.
The current exchange of statements centers on whether the TQKJQ address, which CoinDCX has described as inactive since the 2025 compromise, continued to receive and process deposits linked to the platform well into 2026, and how those flows reconcile with the exchange’s records.
CoinDCX maintains that the activity has no connection to its current operations and that customer funds are secure. ZachXBT’s analysis of the on-chain data suggests otherwise regarding the accounting of deposits routed through the address. As of the latest available statements, the exchange has said it is reviewing the details and will provide further information.
