CoinDCX News: ZachXBT Tells Users To Withdraw All Funds Amid Alleged $16M Loss

Well-known blockchain investigator ZachXBT has told users of Indian crypto exchange CoinDCX to withdraw their money. He accused the exchange’s founders of first denying a roughly $16 million loss and only later admitting it.

“Withdraw all funds from CoinDCX if you value your assets,” ZachXBT wrote on X. He called its co-founders “clowns running a circus.”

How It Started

On October 21, on-chain trackers flagged about $15.99 million in USDT moving out of a wallet linked to CoinDCX. The money was split up and sent to deposit addresses on Binance, OKX and Gate.

CoinDCX co-founder Sumit Gupta quickly dismissed the reports. He said the addresses were old ones compromised in the exchange’s July 2025 hack and that none of CoinDCX’s current wallets had been breached. He called it a false alarm and asked people not to spread rumours.

What ZachXBT Found

ZachXBT said the wallet in question, which starts with “TQKJQ,” was not abandoned. According to him:

• A liquidity provider kept using it for 10 months after the July 2025 hack.
• It continued to collect user deposits and pass them to CoinDCX’s current public hot wallet, as recently as April and May 2026.
• That meant about $15.8 million in user deposits had not been accounted for by the CoinDCX team.

CoinDCX’s Explanation

CoinDCX later posted a fuller update. It said:

• The wallet was compromised in July 2025 and later retired, and users had been told not to send funds to it.
• Some users kept depositing to the old address anyway.
• An automatic process meant to sweep those deposits into secure wallets stopped working for a period, and the company only noticed on the morning it posted the update.
• The resulting “operational losses” were absorbed by CoinDCX, and every affected user deposit was credited.
• Customer assets are kept in separate cold wallets, and trading is running normally.

The exchange did not give a dollar figure for the loss.

Why ZachXBT Is Angry

ZachXBT said CoinDCX denied the theft both publicly and privately before confirming the loss. In his view, that means the team “straight up lied” or was “negligently incompetent.” He grouped CoinDCX with WazirX and BitBNS, two other Indian exchanges that have faced security problems. He also said he still helped CoinDCX freeze a six-figure amount of the stolen funds.

On-chain tracking account Onchain Lens said the funds appear to be moving through little-known services and mixing platforms. It added that the amount drained almost exactly matches the user deposits that went to the untracked wallet.

The Questions Still Open

Critics on X want answers on three points:

• How a failed sweeping process could lead to losses of about $15 million to $16 million
• Why users could still send money to an address that had supposedly been retired
• Why the exchange did not block old deposit addresses automatically

CoinDCX has asked users to rely only on its official channels for updates.