Sumit Gupta's denial was a claim. CoinDCX's own numbers supplied the proof, three days later. Gupta co-founded the exchange and runs it as chief executive. He called a breach report fake on Oct. 22, 20261. By Oct. 25, his own exchange confirmed the loss, at nearly the figure an outside researcher had already named three days earlier3.
A CEO Calls the Warning a False Alarm
CoinDCX, India's largest crypto exchange, had already survived one breach6. Attackers drained about $44 million from its wallets in July 2025. The exchange serves more than 16 million users and lists over 500 crypto assets. Coinbase Ventures backed it years before Coinbase itself invested directly in October 2025. CoinDCX called the 2025 breach contained and moved on. Fifteen months later, a new set of deposit addresses started moving money again.
Gupta answered fast. “The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm,” he wrote on X, hours after the first report surfaced1. He told users the exchange's wallets stayed safe, and he asked people to skip spreading rumors. Pressed again the same day, Gupta struck a softer note. “Yes, aware of that. We're investigating it further, and will share an update soon. We assure that no user funds will be at loss,” he wrote4.
Both statements came from the same man, hours apart. His first message dismissed the report outright. The second admitted CoinDCX was still checking. Both skipped a number entirely.
CoinDCX confirmed its $16 million loss on Oct. 25, 3 days after its false alarm
Dated events in CoinDCX's wallet dispute, Oct. 21 to Oct. 26, 2026
Sources: The Block [1]; CoinDesk [2]; crypto.news [3]; Coinpedia [5].
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 21, 2026 | Darcy flags suspicious transfers |
| Oct. 22, 2026 | ZachXBT's trace; Gupta's denial |
| Oct. 25, 2026 | CoinDCX's loss reaches the press |
| Oct. 26, 2026 | CoinDesk reports full account |
Both sides, in their own words
Does a CEO's denial still carry weight once the ledger it denied turns out to be right?
“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team”
“The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm”
ZachXBT Traces the Money CoinDCX Missed
On-chain investigator ZachXBT reads the public ledger alone. CoinDCX's internal books stay closed to him. On Oct. 22 he published what the ledger showed. “CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team,” he wrote3.
That sentence did three jobs at once. It named a specific address. The timeframe came next, April and May 2026, fifteen months after the exchange called the matter closed. A number followed too, the size of what the company's own books had missed. Darcy, a co-founder of the security firm FlashRescue, flagged the same transfers a day earlier. His post pointed other researchers toward the same wallet5.
ZachXBT read Gupta's denial as something worse than a mistake. “Publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent,” he wrote, and told CoinDCX's users to withdraw their funds if they valued them5. Read plainly, that sentence offers CoinDCX two defenses, lying or incompetence, and both land badly. The company chose, in the end, to prove the milder one.
CoinDCX Admits What It Denied
Three days after Gupta's first denial, CoinDCX's own numbers caught up to ZachXBT's. The exchange's blog post, dated Oct. 21, 2026, named the broken part of its own system. “This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result,” the post said2.
CoinDCX's explanation pointed to a tool, apart from any attacker. Every exchange runs an automated sweeping service. The software checks each customer deposit address on a schedule, then moves the funds it finds into the exchange's main vault. A bank branch does the same thing with cash, sending its daily take to a central vault instead of keeping it in the till. CoinDCX said that service "had failed for a particular period," so deposits kept landing in a wallet the exchange believed it had retired1. The company gave itself cover for the delay. “It took us some time to do the thorough review of the deprecated infrastructure and confirm the sequence of events,” the blog post said2.
The final number matched ZachXBT's trace almost exactly. CoinDCX confirmed a loss of 15.99 million USDT, about $16 million, and said it would cover the whole amount itself. “We want to reiterate that all user funds remain safe in secure, segregated cold wallets,” the company said2. Every customer balance stayed whole, by CoinDCX's own account. The sweep service, by that same account, lost track of the money for months before anyone outside the company caught it.
CoinDCX's $15.99 million loss, confirmed Oct. 25, is a third of its $44 million 2025 hack
Confirmed dollar losses from CoinDCX's two wallet incidents, in millions of US dollars
- Oct. 2026 loss: $15.99M
- July 2025 hack: $44.00M
Sources: The Block [1]; CoinDesk [2].
Read the chart as a table
| Item | Value | Note |
|---|---|---|
| July 2025 hack | $44.00M | CoinDCX's first wallet breach |
| Oct. 2026 loss | $15.99M |
What Each Side Would Need to Be True
ZachXBT's reading needs CoinDCX's timeline to hold up under a harder question. How does a sweep service fail silently for ten months, across two incidents, before anyone inside the company catches it? A charge of negligence stands on its own facts if the honest answer is that staff skipped the check entirely. That same charge softens if CoinDCX can show its own monitoring caught the sweep failure before ZachXBT posted. Then it reads as a company already fixing a known problem.
CoinDCX's defense needs a different fact to hold: that the money, once found, left every customer's balance untouched. The company says it covered the full $15.99 million from its own funds. That matches the same move it made after the $44 million breach in 202526. The claim is checkable the next time CoinDCX publishes a reserve report. This is a second absorbed loss in fifteen months. Coinbase valued CoinDCX's treasury at $2.45 billion when it invested in the exchange in October 20251. The repeat tests how much capital CoinDCX can keep setting aside for its own mistakes.
Regulatory stakes sit underneath both claims. CoinDCX has run as a registered reporting entity with India's Financial Intelligence Unit since 20237. That status requires it to file suspicious-transaction reports under the same anti-money-laundering law that binds Indian banks. A second lapse inside systems that law already requires CoinDCX to monitor gives Indian regulators their own reason to look. Regulators now have a second account to weigh against CoinDCX's own.
Both claims can be true at once. ZachXBT's trace was right about the money. CoinDCX's claim that users kept their funds may also hold. What the episode settles runs narrower and plainer. A CEO's same-day denial, issued before his own staff had finished checking, told users less than a stranger reading the public chain already knew.
By the numbers
- CoinDCX confirmed a $15.99 million USDT loss on Oct. 21, 2026, from a deposit address its sweep service stopped clearing2.
- Three days passed between Gupta's "false alarm" post on Oct. 22 and CoinDCX's confirmation reaching the press on Oct. 251.
- ZachXBT calculated a $15.8 million loss from the same address on Oct. 22, 2026, three days before CoinDCX's own confirmation became public3.
- Ten months is how long ZachXBT says a liquidity provider kept using the compromised address after the 2025 breach3.
- A separate breach in July 2025 cost CoinDCX $44 million, the incident that first compromised the wallet infrastructure6.
- April and May 2026 were the months ZachXBT says the same address last swept deposits into CoinDCX's current public hot wallet3.
- Coinbase valued CoinDCX at $2.45 billion when it invested in the exchange in October 2025, a year before this second absorbed loss1.
What to watch
CoinDCX's next transparency report should date when its own monitoring first caught the sweep failure, set against ZachXBT's Oct. 22 post. Indian regulators may ask the exchange for an independent audit of the deprecated wallet infrastructure, given it has now failed twice. ZachXBT's call for users to withdraw funds gets a test ahead. Deposit and withdrawal volumes in the weeks to come will show the answer, a figure the exchange's own transparency page tracks. A third incident inside the same old infrastructure would change the shape of this question. It would turn an accountability dispute CoinDCX settled on its own terms into a pattern regulators act on instead.
Sources
- Zack Abrams, "CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a 'false alarm'," The Block, Oct. 25, 2026, https://www.theblock.co/news/business/2026-10-25-coindcx-confirms-16-million-loss-from-retired-wallets-days-after-ceo-called-breach-reports-a-false-alarm-431617
- Omkar Godbole, "CoinDCX absorbs $16 million loss from internal process failure tied to retired wallet," CoinDesk, Oct. 26, 2026, https://www.coindesk.com/markets/2026/10/26/coindcx-absorbs-usd16-million-loss-from-internal-process-failure-tied-to-retired-wallet
- Rony Roy, "CoinDCX denies second hack claims as ZachXBT questions wallet activity," crypto.news, Oct. 22, 2026, https://crypto.news/coindcx-denies-second-hack-claims-as-zachxbt-questions-wallet-activity/
- Zoltan Vardai, "ZachXBT alleges $15.8M in unaccounted CoinDCX deposits, questions Indian exchange trust," The Crypto Times, Oct. 22, 2026, https://www.cryptotimes.io/2026/10/22/zachxbt-alleges-15-8m-in-unaccounted-coindcx-deposits-questions-indian-exchange-trust/
- Anjali Belgaumkar, "CoinDCX News: ZachXBT Tells Users To Withdraw All Funds Amid Alleged $16 Million Loss," Coinpedia, Oct. 22, 2026, https://coinpedia.org/news/coindcx-news-zachxbt-tells-users-to-withdraw-all-funds-amid-alleged-16m-loss/
- Jagmeet Singh, "Indian crypto exchange CoinDCX confirms $44 million stolen during hack," TechCrunch, July 21, 2025, https://techcrunch.com/2025/07/21/indian-crypto-exchange-coindcx-confirms-44-million-stolen-during-hack
- "New Anti-Money Laundering Laws & CoinDCX: We are now an FIU-registered entity," CoinDCX, March 20, 2023, https://coindcx.com/blog/announcements/new-anti-money-laundering-laws-coindcx-now-an-fiu-registered-entity