CoinDCX Admits Operational Losses After Sweep of Old Compromised Wallets Failed
Published October 22, 2026, 9:50 PM PKT. Based on a CoinDCX statement posted on X on October 22, 2026, quoted verbatim by CoinTelegraph (primary source), and reporting by CoinTelegraph, The Hindu BusinessLine, TradingView and Coinpedia on October 22, 2026 (secondary sources). This is a follow-up to MABOnChain article 328, published at 9:15 PM PKT today, which reported blockchain investigator ZachXBT challenge to CoinDCX account of the disputed wallets and ended by saying CoinDCX had not publicly reconciled the TQKJQ transaction history. CoinDCX admission reported here is the new development since that article. The admission is the exchange own statement, not an independently confirmed finding, and no new breach of CoinDCX active wallets and no customer loss has been independently confirmed.
CoinDCX admitted on October 22, 2026 that it took operational losses from a failure in the way it handled deposits sent to old wallet addresses compromised in its July 2025 hack. In a statement posted on X on Thursday, after CoinTelegraph first article on the transfers, CoinDCX said some users continued depositing crypto into addresses compromised during the July 2025 hack despite warnings to stop. The exchange said its operational process is designed to regularly sweep any such deposits out of the old addresses so the funds can be properly accounted for and secured. "For a particular period, this sweeping process failed, which got identified today morning," CoinDCX said, according to The Hindu BusinessLine. "This failure led to some operational losses, which were absorbed by CoinDCX." CoinDCX did not disclose the size of the loss. The admission changes the shape of the story: where the exchange first account was that the disputed wallets were abandoned and the claims misleading, its second account concedes a real operational failure, a real loss, and a fix paid for by the exchange itself.
The failed sweep and the Thursday morning discovery
The mechanism CoinDCX describes is a standing cleanup process, not a one-off transfer. Users kept sending crypto to deposit addresses created in January 2025 and compromised in the July 2025 incident, even after the exchange told them to stop, and the exchange says it regularly moved those deposits into secure wallets so they could be accounted for. For an unspecified period that process stopped working, and the fault was spotted on Thursday morning, October 22, according to the TradingView live updates and The Hindu BusinessLine. CoinDCX added a further detail when asked about the wallet itself: the encryption key and other details of the wallet were stolen from the exchange, leaving it with no method to deactivate the wallet, The Hindu BusinessLine reported. That detail matters because it explains why warning users was the exchange main defense for an address it could not switch off. It does not, on its own, explain the full movement of funds on October 21, and CoinDCX has not published a transaction-by-transaction reconciliation of that night. The exchange said all affected deposits had been credited to users accounts, its current wallets were unaffected, no funds from active wallets had been compromised, and customer assets remained in segregated cold wallets, CoinTelegraph reported.
From denial to admission in one day
The admission arrived after a full day of escalating challenges, and the sequence is what gives it weight. The transfers were first flagged on October 22 by Darcy, co-founder of asset recovery platform FlashRescue, who said about 15.99 million USDT and 5,783.81 TRX moved late on October 21 from addresses labeled as CoinDCX hot wallets and deposit addresses to a single TRON address, with the largest single transaction at 15,819,002 USDT, according to CryptoBriefing. CoinDCX first response, from co-founder and CEO Sumit Gupta, was that CoinDCX wallets are not breached, that the addresses used to belong to CoinDCX before the July 2025 hack, and that the claims were misleading. Blockchain investigator ZachXBT then challenged that account, saying deposit address TQKJQ stayed in use by a liquidity provider for about 10 months after the July 2025 incident and swept user deposits and gas to CoinDCX current public hot wallet as recently as April and May 2026, leaving $15.8 million in user deposits unaccounted for, as MABOnChain reported in article 328. Gupta replied that he was aware of the point and that the team was investigating further, assuring that no user funds would be at loss. The admission followed that exchange. Read together, the sweep process CoinDCX now describes is also a partial answer to ZachXBT: deposits into old addresses were being moved onward by design, which is consistent with the April and May 2026 sweeps to the current hot wallet, and the failure was in a later period when that process stopped working. What CoinDCX has not done is confirm ZachXBT $15.8 million figure, disclose its own loss figure, or date the failure period.
The $8.9 million trail researchers traced
Separate from the headline $16 million total, a second researcher trail has drawn attention, and it remains unverified. A blockchain security researcher said about 8.93 million USDT linked to CoinDCX wallets had moved to other exchanges, including 5.47 million USDT to OKX, 2.02 million USDT to Binance and 1.39 million USDT to Gate, plus 50,000 USDT to another destination, according to the TradingView live updates. The same researcher pointed to transfers from reserve-listed wallets to a suspected attacker address, and said part of the funds reached addresses linked to Huione and Xinbi, marketplaces tied to money laundering. None of those claims has been independently verified, and the TradingView updates note that explicitly. The researcher also questioned CoinDCX account by noting that hot wallet TFLxNH, which appears in the exchange latest proof of reserves report, kept sending routine 15 TRX gas payments both before and after the reported hack. CoinDCX has not publicly answered that specific gas payment observation. Readers should treat the $8.9 million trail as an allegation under investigation, not as a confirmed second loss, and should not add it to the $16 million total: the two figures describe overlapping movements seen through different analyses, not two separate thefts.
What remains unproven
Four things remain unproven, and keeping them separate is what keeps this story accurate. No new security breach of CoinDCX active wallets has been independently confirmed: the transfers are visible on chain, but whether they were unauthorized, and whether the receiving wallets belong to an attacker, has not been independently established. No customer loss has been confirmed: CoinDCX says affected users were credited and customer funds are safe, and no regulator or auditor has contradicted that. The size of CoinDCX operational loss is undisclosed, so there is no confirmed link between the loss CoinDCX absorbed and either the $15.99 million in October 21 transfers or ZachXBT $15.8 million unaccounted figure. And the July 2025 context is settled history, not present allegation: attackers stole approximately $44 million from an internal liquidity account used by the exchange, CoinDCX covered the losses through its treasury, and the company later offered a recovery bounty of up to 25 percent of recovered assets, capped at $11 million, according to crypto.news. The open question is now narrower: for how long the sweep process failed, how much it cost, and whether the exchange full accounting, when it comes, matches the on-chain record investigators have already published. Trading continued normally through the day, according to Coinpedia, and CoinDCX had not responded to Cointelegraph inquiry at the time of that outlet update.
This article is news reporting and is not investment advice.
Sources
- CoinDCX statement on X, October 22, 2026, quoted verbatim by CoinTelegraph (primary source)
- CoinTelegraph, CoinDCX Admits Losses After $16M Wallet Transfers Draw Scrutiny (October 22, 2026, updated 12:32 pm UTC), secondary source
- The Hindu BusinessLine, CoinDCX confirms functioning of rogue wallets, siphoning user funds worth $16 million (October 22, 2026), secondary source
- TradingView News, CoinDCX Hack Today Live Updates (October 22, 2026), secondary source
- Coinpedia, CoinDCX Faces New Questions After Its $44M Hack (October 22, 2026), secondary source
- crypto.news, CoinDCX denies second hack claims as ZachXBT questions wallet activity (October 22, 2026), secondary source
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
ZachXBT Challenges CoinDCX Account, Says $15.8M in Deposits Went Unaccounted For
Blockchain investigator ZachXBT said on October 22, 2026 that a CoinDCX deposit address, TQKJQ, stayed in use by a liquidity provider for about 10 months after the exchange's July 2025 hack and swept user deposits and gas to CoinDCX's current public hot wallet as recently as April and May 2026, contradicting CoinDCX's claim that the disputed wallets were abandoned after the hack. ZachXBT said the history means $15.8 million in user deposits was unaccounted for by the exchange team. CoinDCX has said its wallets are not breached and that it is investigating, and no new breach or customer loss has been independently confirmed.
Fireblocks Denies Report of $2.5 Billion Visa Acquisition Talks
Crypto custody firm Fireblocks said on October 22, 2026 that reports of a $2.5 billion acquisition by Visa are not true at present time, pushing back the same day on an Axios report that Visa was in late-stage talks to buy the company. The reported price would value Fireblocks about 69 percent below the $8 billion valuation from its January 2022 Series E round, when it raised $550 million. Visa declined to comment on the speculation, and no deal, terms or timetable has been announced by either company.
Central Bank of Ireland Fines Coinbase Ireland 3.25 Million Euros Over Customer Fund Safeguarding Failures
The Central Bank of Ireland has fined Coinbase Ireland Limited 3,252,618 euros for breaching customer-fund safeguarding and outsourcing obligations between November 2020 and August 2025, the regulator announced on October 22, 2026, after a settlement reached on October 21, 2026. The regulator said the firm left its designated safeguarding account underfunded for lengthy periods, with daily shortfalls reaching 5.2 million euros in 2024, while Coinbase said it self-reported the issues in January 2024, has fully fixed them, and that no customer lost money or lost access to funds. The sanctions, a reprimand plus the fine, take effect only once the High Court of Ireland confirms them.
CoinDCX Denies New Hack as $16M in USDT Moves From Old Compromised Wallets
Indian exchange CoinDCX said on October 22, 2026 that about 15.99 million USDT and 5,783.81 TRX that moved on October 21 came from old wallet addresses created in January 2025 and compromised in its July 2025 hack, not from a new breach, after blockchain security researcher Darcy flagged the transfers from addresses labeled as CoinDCX hot wallets and deposit addresses to a single TRON address. CoinDCX said user funds are safe and trading continues as usual, while the receiving address split the funds onward toward deposit addresses at Binance, OKX and Gate, and no independent confirmation of the old wallet link has yet appeared.
NEAR Jumps 7% as Business Launch Targets Private Crypto Treasuries
NEAR rose about 7% to $5.31 on October 21, 2026, a day after NEAR Protocol launched NEAR Business, a private treasury platform that lets teams pay staff and vendors, swap assets and allocate capital across more than 35 blockchains while keeping payroll and treasury balances confidential from the market but legible to auditors, according to NEAR and Stocktwits reporting. The move also landed as a House of Stake vote opened on cutting annual issuance from 2.5% to 1.6% over 24 months, and as NEAR Intents passed $32 billion in cumulative volume in the third quarter of 2026.
Solana Alpenglow Goes Live on Mainnet in Biggest Consensus Switch Since Launch
Solana has activated Alpenglow, its first major consensus upgrade, on mainnet on October 21, 2026, replacing the TowerBFT voting system it has used since launch with a new protocol called Votor that targets transaction finality in about 150 milliseconds, down from roughly 12.8 seconds. CryptoBreaking, citing the Solana Foundation Alpenglow dashboard, put activation at about 1:54 pm UTC, in epoch 1064, while the dashboard reading at press time showed finality of about 6.6 seconds and throughput of about 4,721 transactions per second, a reminder that the 150 millisecond figure is a target to converge toward, not an instant day one measurement. The second Alpenglow phase, Rotor, which would replace the Turbine block propagation system, does not activate with Votor and remains unscheduled.
Standard Chartered Signs Definitive Deal to Take Full Ownership of Zodia Custody
Standard Chartered has signed definitive agreements to acquire 100% of Zodia Custody, the institutional digital asset custodian it helped create, turning a takeover first agreed in principle in May into a binding deal. Standard Chartered I H Limited will acquire 100% of Zodia Custody UK Limited, the parent of Zodia's regulated operating entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg, subject to regulatory approvals and customary closing conditions, with financial terms undisclosed. After completion, Zodia's custody business joins the bank's Securities Services division, while its software and professional services assets move to Zodia Solutions, a new independent entity under SC Ventures backed by bank investors including Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD.
OCC Finalizes First GENIUS Act Stablecoin Rule, Sets January 18, 2027 Start Date
The U.S. Office of the Comptroller of the Currency has issued the first final rule implementing the GENIUS Act, setting reserve, redemption and capital standards for payment stablecoin issuers under its jurisdiction, effective January 18, 2027. Issuers must hold reserves at least equal to their outstanding stablecoins and generally redeem within two business days, while the agency dropped a proposed presumption that affiliate rewards deals violate the law's yield ban, leaving existing rewards programs to case-by-case review. The rule covers national banks, federal savings associations, federal branches and nonbank firms seeking federal qualified issuer status, with a $5 million capital floor, while anti-money-laundering rules will follow in separate rulemaking with the Treasury.
Aave Backs Tokenized SpaceX Shares as Collateral With Strict Guardrails Ahead of 2.43 Billion Share Unlock
Aave risk adviser LlamaRisk has backed listing tokenized SpaceX shares, trading as SPCXc, as collateral on Aave V4's Equities Hub on Base, but only under the hub's toughest terms: a 55% collateral factor, a 6.5% maximum liquidation bonus, a 1,000 basis point risk premium and a 37,000 token supply cap worth about $5.8 million. The caution reflects SpaceX's four months of public trading history and a lock-up calendar that releases 2.43 billion shares, 84% of the current float, between October 26 and December 8, 2026. SPCXc would be collateral-only, with USDC the only borrowable asset, and larger liquidations would depend on redemptions or derivatives hedges because onchain depth is thin.
Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M
Wallets linked to the April 2026 Drift Protocol exploit sent about 18,800 ETH, worth roughly $46 million, into Tornado Cash on October 21, 2026, according to blockchain tracker Onchain Lens, taking the two-day total to 44,510 ETH, worth about $109 million. The move follows the roughly $61 million first tranche on October 20 that MABOnChain reported, and Arkham Intelligence labeled wallets still held about 56,569 ETH, worth roughly $138 million, after the latest deposits. Drift has attributed the April attack, which cost about $295 million, to a North Korean threat group, and victims are claiming through a DFX recovery token scheme that started with a pool of about $3.1 million.
France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures
France's Treasury, AMF, Banque de France and ACPR published a joint response on October 21, 2026 to the European Commission's MiCA review consultation, proposing that crypto platforms which actively connect customers to DeFi protocols should face liability for certain client losses when they fail to vet protocols or ignore known risks. The proposal would also move supervision of significant crypto firms to ESMA, lower the 15 million daily active user threshold for significant status, and rework MiCA's stablecoin categories after zero asset-referenced tokens were authorized. The Commission's report to EU lawmakers is due by June 30, 2027.
UK High Court Lets 16,000 Victims Appeal Ruling on 61,000 Seized Bitcoin in Qian Zhimin Case
The UK High Court has granted about 16,000 Chinese fraud victims permission to appeal its October 12, 2026 ruling that Chinese law governs property claims over more than 61,000 Bitcoin seized in the Qian Zhimin money laundering case, according to PANews reporting on October 21 that cited Caixin. The appeal keeps alive the victims' bid to claim a share of a stash worth about 3.8 billion pounds, after the original ruling said their claims must be tested under Chinese law rather than English property law. Lawyers at the follow-up hearing also discussed litigation costs from the earlier dispute and how individual applicants can continue or withdraw their claims.
Ether ETFs Pass $1.08B in October Outflows, Biggest Monthly Drain of 2026
U.S. spot Ether ETFs have shed $1.08 billion so far in October 2026, the biggest monthly outflow of the year and the largest since November 2025, after Tuesday added $26 million to the drain, according to SoSoValue data reported by Cointelegraph. The withdrawals have erased September's $832 million in net inflows and left year to date net inflows at about $485 million, while Ether has fallen 9.7% in October to $2,438. Bitcoin funds moved the other way at the start of the week, pulling in $527 million on Monday before adding $23 million on Tuesday.
Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets
Belgian hardware wallet maker NGRAVE disclosed on October 19, 2026 that attackers hijacked a third party push notification provider for its LIQUID companion app and sent fake security alerts to users on October 17, tricking them into entering recovery phrases on a counterfeit website and draining about $2.56 million from 70 wallets across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. NGRAVE says its ZERO hardware wallets were never compromised, and its chief executive admitted the company had absolutely and utterly failed in its most basic security duty.
Zcash Jumps 10% as NU7 Locks In Mainnet Activation for 25-Second Blocks
Zcash jumped about 10% on October 21, 2026, trading near $1,260, after developers set the mainnet activation height for NU7, the network upgrade that cuts Zcash block times from 75 seconds to 25 seconds. The activation height is the block number at which every node switches to the new rules, and NU7 pairs the threefold speedup with a Network Sustainability Mechanism that routes 60% of each block's transaction fees into a reserve paid back out over time. ZEC has gained roughly 45% in the past week and about 138% over 30 days, pushing its market capitalization back above $20 billion for the first time since 2016.
Qubic Restarts Blockchain and Opens Recovery Claims After $1.4M Wallet-Seed Hack
Qubic has restarted its blockchain and opened a recovery-claims platform after a wallet-seed vulnerability drained about $1.4 million in QU tokens from 1,404 accounts, the project said in its latest update. The network resumed processing ticks at 8:00 pm on October 19, advancing past tick 85,371,949 where it was halted on Sunday, October 18, after the project’s Computor validators approved a recovery plan and the first batch of recovered funds was returned to verified owners. Qubic says 87.1% of the stolen tokens stayed immobilized on the paused network while 12.9% went to MEXC, which froze the receiving account, and it warns that any wallet created with its web wallet before version 4.26.4, released October 19, should be treated as insecure. Affected users have until May 1, 2027 to submit claims through the project’s sole official reclaim site.
CME Logs First Trades in Bitcoin Cash and Uniswap Futures With FalconX-GSR Debut Block Trade
CME Group confirmed on October 20, 2026 that FalconX and GSR executed the first block trade in its new Bitcoin Cash and Uniswap futures, with trading now underway on the world's largest derivatives venue. The launch extends CME's single-asset crypto futures lineup to 11 tokens and makes UNI the first DeFi protocol token with standalone CME futures, in standard 10,000-UNI and micro 1,000-UNI sizes trading 24 hours a day. CME's crypto futures and options business has averaged more than 242,000 contracts a day in 2026, about $7.9 billion in notional value, with its five earlier altcoin futures this year adding nearly $2 billion in year-to-date notional.
SkyAI Sells Entire Solana Treasury, Launches $201.3M Tender Offer
SkyAI, the Nasdaq-listed company formerly known as Sharps Technology, has sold its entire Solana treasury and launched a $201.3 million cash tender offer to repurchase up to 95% of its shares and warrants, according to an October 19, 2026 SEC filing. The company held $223.8 million in cash and zero SOL as of October 16, reversing a strategy that at its peak held more than 2 million SOL bought for over $400 million. The $3-per-share offer expires October 29, but major shareholder Bastion Trading, with about 9.99% of the stock, is refusing to participate and wants at least $3.50 plus an independent review of the SOL sales.
Ireland Moves Another 500 BTC From Clifton Collins' Seized Wallets to Coinbase Prime
A wallet linked to convicted Irish drug trafficker Clifton Collins moved 500 BTC, worth about $41.5 million, to Coinbase Prime on October 20, 2026, the fifth 500-BTC tranche recovered from his long-thought-lost Bitcoin fortune this year. Blockchain intelligence firm Arkham Intelligence flagged the transfer; about 2,500 BTC have now moved from the wallets in 2026, while roughly 3,500 BTC worth about $290 million remain. Collins bought about 6,000 BTC in 2011 and 2012 at roughly $5 each, printed the private keys on paper and hid them in a fishing rod case, and lost access in 2017. Ireland's Criminal Assets Bureau, with help from Europol's European Cybercrime Centre, began opening the wallets in March 2026.
Stablecoin Transfers Quadruple to $891B in Q3 as U.S. Banks Test the Rails, Coinbase Study Finds
Research conducted for Coinbase by The Block Pro Research found that adjusted stablecoin transfer volume hit $891 billion in the third quarter of 2026, more than four times the level of early 2023, with over $400 million moving per hour and 73% of volume settling outside U.S. banking hours. The study, titled The Always-On Dollar, says seven of the ten largest U.S. banks have tested stablecoins or tokenized deposits for settlement, with the remaining three announcing plans to do so, while 293 million blockchain addresses now hold stablecoins, more than the combined card bases of American Express and Discover.
ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds
Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service on Hyperliquid Core, are tied to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT traced more than $20 million in inflows above a $10,000 review threshold to ransomware payments, cryptocurrency exploits, malware and social engineering attacks, including the September 2026 incidents at DCENT Wallet, Fetch.ai and Axelar, plus an October exploit on the Gamdom gambling platform. He also alleged the service's operator sourced Monero liquidity through KuCoin, identifying more than 3,000 deposits from associated addresses.