There is no confirmed new CoinDCX hack: the October 21 TRON movements are real, but CoinDCX says they involved addresses compromised in July 2025 and that current customer and central wallets were not breached. CoinDCX’s statement

CoinDCXOct 22, 2026, 09:58 UTC

The reported trail starts with 15,819,002 USDT sent from the CoinDCX deposit address TQKJQr…qWUy to TAg6SZ…5bT; the consolidation address then split USDT among multiple recipients. Darcy reported about 15.99 million USDT and 5,783.81 TRX moved in total on October 21, with portions routed to Binance, OKX and Gate. Darcy’s initial report

Darcy later alleged that the flow included 2,020,943 USDT to Binance, 5,465,933 USDT and another 50,000 USDT to OKX, 1,392,199 USDT to Gate, plus transfers to addresses associated with Huione and Xinbi. Those exchange totals and affiliations are his attribution; the records available here do not independently establish the full downstream totals. Darcy’s follow-up

ZachXBT disputed CoinDCX’s claim that the address had been abandoned, saying it remained in use by a liquidity provider for ten months and swept user deposits to a current public hot wallet as recently as April and May 2026; he said $15.8 million in deposits was unaccounted for. ZachXBT’s post The available evidence establishes suspicious transfers and competing explanations, but does not settle whether CoinDCX suffered a new breach or customer funds were stolen.

Ask your own

Case file

CoinDCX

Answered Oct 22, 2026, 09:58 UTC

Sources 4

Research trace 8

The linked original X post
Latest posts of @WuBlockchain
Latest posts of @CoinDCX
The page t.me
These reads should surface the named investigator’s post and address evidence, the exchange’s full response, subsequent investigator rebuttals, and independent reports that may identify the TRON addresses and transfer trail.
CoinDCX’s full response and the investigator’s on-chain rebuttal may distinguish an old-wallet reuse from a new compromise. The reports name a roughly $16 million TRON flow but no addresses or transaction hashes, so I’m checking the original posts and whether they disclose identifiers needed to verify the consolidation and exchange deposits.
CoinDCX says the flagged addresses were compromised in July 2025 and later reused, while ZachXBT says the reported deposit address remained active through April and May 2026 and swept customer deposits to a current hot wallet. The available posts identify the consolidation address as TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT; I’m checking the original investigator material and TRON transfer data for the exact flow and whether it establishes a new loss.
The earlier results confirm a 15,819,002 USDT transfer into TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT and show subsequent transfers from that address, but they do not establish the full routing or whether this was a fresh breach. These reads check the named PoR and deposit addresses, downstream recipients, and Darcy’s follow-up claims against the TRON records.