CoinDCX Denies New Hack as $16M in USDT Moves From Old Compromised Wallets
Published October 22, 2026, 3:15 PM PKT. Based on CoinDCX posts on X on October 22, 2026 (primary source, quoted by CryptoBriefing and CoinGabbar), and reporting by CryptoBriefing, CoinGabbar and PANews on October 22, 2026 (secondary sources). This is the first MABOnChain article on the October 21 CoinDCX wallet movements and the exchange denial, and it is distinct from MABOnChain's coverage of the July 2025 CoinDCX hack itself.
Indian crypto exchange CoinDCX denied on October 22, 2026 that it had suffered a new hack, after about 15.99 million USDT and 5,783.81 TRX moved on October 21 from addresses labeled as its hot wallet and deposit addresses to a single TRON address, according to PANews and CryptoBriefing. The exchange said the transactions involved old wallet addresses created in January 2025 that were compromised in July 2025 and have not been used since, and it described claims circulating on X about the transfers as misleading, CryptoBriefing reports. "Users' funds are safe," CoinDCX said in its post, adding that trading and investing continued as usual. Co-founder Sumit Gupta separately rejected the fresh breach reading in a post on X, according to CoinGabbar.
The $16 million trail to Binance, OKX and Gate deposit addresses
The on-chain trail is not in dispute in its broad shape, only in what it means. Darcy, an executive at blockchain security firm Salus, traced the activity to 23:35:54 UTC+8 on October 21, 2026, CryptoBriefing reports, when addresses identified as CoinDCX hot wallets and multiple deposit addresses transferred the assets to the TRON address TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, according to PANews. The largest single transfer was 15,819,002 USDT, PANews reports, and the receiving address then split the funds through multiple wallets before some of the flows reached deposit addresses associated with Binance, OKX, Gate and other exchanges, according to the transaction report cited by CryptoBriefing. CoinGabbar notes that splitting funds and sending them to exchange deposits is a standard laundering step, and that it also gives those exchanges a chance to freeze assets, though whether any of the three has done so is not yet known.
That last point is where the two readings of the same trail diverge. On Darcy's reading, funds left addresses labeled as the exchange's hot wallet and deposit addresses and moved toward other exchanges, which is the pattern that set off the hack claims on X. On CoinDCX's reading, the labeled addresses are legacy addresses from January 2025, compromised in the July 2025 attack, and the exchange says its current central and user wallets sent nothing to them, according to CoinGabbar. Both readings agree that money moved on October 21. They disagree on whether the movement represents a new unauthorized access to the exchange or the shuffling of funds from wallets that were already compromised more than a year ago. The exchange has not published wallet-level proof tying the October 21 addresses to the July 2025 compromise, and CoinGabbar notes that independent confirmation has not appeared.
The July 2025 hack that makes the old wallet claim plausible
The July 2025 incident is what makes the exchange's explanation credible on its face, and it is also why the new claims spread so fast. CoinDCX lost approximately $44 million in a July 2025 hack targeting an internal hot wallet used to provide liquidity on a partner exchange, CryptoBriefing reports, and CoinGabbar reports that the loss came from an internal liquidity account, not customer cold wallets, and that the company covered the loss from its treasury, isolated systems and paused some Web3 services. A CoinDCX software engineer was reportedly arrested shortly afterward in connection with the investigation, CryptoBriefing adds, but the company did not publicly establish his role. A compromised wallet from that incident would remain visible on public blockchains long after the attack, and assets in it could be moved at any later date by whoever controls the keys, which is exactly the mechanism CoinDCX says is behind the October 21 transfers.
The exchange's denial also fits a pattern in how it has handled security claims since July 2025. CoinDCX said the old addresses were created in January 2025, were compromised in July 2025, and have not been used by the exchange since, and it denied any connection between the reported activity and its current operations, according to CryptoBriefing. CoinGabbar adds that the company told customers to follow only official channels, including @CoinDCX, @CoinDCX_Cares and @smtgpt, and to treat unsolicited messages about refunds or recovery as scams. That warning matters because hack scares routinely spawn phishing campaigns aimed at users who fear their funds are at risk, and the exchange's message to users is that no action is needed on their accounts.
What remains unverified: freezes, independent tracing and a fuller note
Three questions will decide whether the denial closes the story or only pauses it. The first is independent tracing: whether analysts outside the exchange confirm that the October 21 addresses match the wallets compromised in July 2025, which would settle the central factual dispute. The second is freezes: whether Binance, OKX, Gate or any other receiving exchange has frozen any of the onward flows, which would show where the funds now sit and whether anyone is treating them as stolen. The third is a fuller incident note from CoinDCX itself, with wallet-level detail, rather than short posts on X. CoinGabbar lists the same open items, including the next Proof of Reserves update, and notes that if independent tracing ties the transfers to the 2025 compromise, the episode shows that old wallets stay dangerous long after an incident, while if it does not, the exchange will face pressure to open its books.
For users, the practical state of play is narrow. CoinDCX says funds are safe and trading is normal, and no regulator, exchange or security firm has reported a new CoinDCX breach or a freeze of customer funds. At the same time, about $16 million did move from addresses labeled as the exchange's, the onward trail into other exchanges' deposit addresses is documented in the transaction report, and the old wallet explanation still rests on company statements alone. Until independent tracing or a freeze confirms one reading, the accurate description is a disputed $16 million movement that CoinDCX attributes to wallets compromised in July 2025, not a confirmed new hack and not yet a fully verified old wallet transfer either.
This article is news reporting and is not investment advice.
Sources
- CoinDCX, posts on X (October 22, 2026), quoted by CryptoBriefing and CoinGabbar (exchange denial, old January 2025 addresses compromised in July 2025, user funds safe, trading continues as usual), primary source
- CryptoBriefing, CoinDCX rejects hack claims after $16 million in USDT transfers reported (October 22, 2026), secondary source
- CoinGabbar, CoinDCX Hack: $16M on the Move, but Is Anyone Hacked? (October 22, 2026), secondary source
- PANews, CoinDCX Suspected of Losing About 16 Million USDT in Theft, Funds Split and Transferred to Multiple Exchanges (October 22, 2026), secondary source
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Trump Says Nearly $1B in Scam-Linked Crypto Is Frozen as DOJ Goes Nationwide
President Donald Trump said at an October 21, 2026 White House cybercrime roundtable that federal authorities have frozen nearly $1 billion in cryptocurrency tied to foreign scammers and prevented at least $1.6 billion in losses this year, while Attorney General Todd Blanche announced a newly established Justice Department cyber-enabled scam initiative that deploys dozens of prosecutors across all 94 U.S. Attorneys offices. The Justice Department Scam Center Strike Force lists $938,460,156.82 in cryptocurrency restrained as of October 15, 2026, money held back from movement, not money already returned to victims.
Aerodrome and Velodrome Merge Into Aero, a Spot Exchange Across Seven Chains
Aerodrome and Velodrome have officially merged to launch Aero, an onchain spot exchange across Ethereum mainnet, Base, Robinhood Chain, Ink, OP Mainnet, Arc, and Arbitrum, according to a Wednesday statement reported by The Block on October 21, 2026. The seven networks together handle about $120 billion a month in decentralized exchange trading, the project said. Existing AERO tokens convert one for one into the new AERO, VELO converts at about 0.044 new AERO, and holders must migrate by hand through upgrade portals because nothing converts automatically.
NEAR Jumps 7% as Business Launch Targets Private Crypto Treasuries
NEAR rose about 7% to $5.31 on October 21, 2026, a day after NEAR Protocol launched NEAR Business, a private treasury platform that lets teams pay staff and vendors, swap assets and allocate capital across more than 35 blockchains while keeping payroll and treasury balances confidential from the market but legible to auditors, according to NEAR and Stocktwits reporting. The move also landed as a House of Stake vote opened on cutting annual issuance from 2.5% to 1.6% over 24 months, and as NEAR Intents passed $32 billion in cumulative volume in the third quarter of 2026.
Solana Alpenglow Goes Live on Mainnet in Biggest Consensus Switch Since Launch
Solana has activated Alpenglow, its first major consensus upgrade, on mainnet on October 21, 2026, replacing the TowerBFT voting system it has used since launch with a new protocol called Votor that targets transaction finality in about 150 milliseconds, down from roughly 12.8 seconds. CryptoBreaking, citing the Solana Foundation Alpenglow dashboard, put activation at about 1:54 pm UTC, in epoch 1064, while the dashboard reading at press time showed finality of about 6.6 seconds and throughput of about 4,721 transactions per second, a reminder that the 150 millisecond figure is a target to converge toward, not an instant day one measurement. The second Alpenglow phase, Rotor, which would replace the Turbine block propagation system, does not activate with Votor and remains unscheduled.
Standard Chartered Signs Definitive Deal to Take Full Ownership of Zodia Custody
Standard Chartered has signed definitive agreements to acquire 100% of Zodia Custody, the institutional digital asset custodian it helped create, turning a takeover first agreed in principle in May into a binding deal. Standard Chartered I H Limited will acquire 100% of Zodia Custody UK Limited, the parent of Zodia's regulated operating entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg, subject to regulatory approvals and customary closing conditions, with financial terms undisclosed. After completion, Zodia's custody business joins the bank's Securities Services division, while its software and professional services assets move to Zodia Solutions, a new independent entity under SC Ventures backed by bank investors including Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD.
OCC Finalizes First GENIUS Act Stablecoin Rule, Sets January 18, 2027 Start Date
The U.S. Office of the Comptroller of the Currency has issued the first final rule implementing the GENIUS Act, setting reserve, redemption and capital standards for payment stablecoin issuers under its jurisdiction, effective January 18, 2027. Issuers must hold reserves at least equal to their outstanding stablecoins and generally redeem within two business days, while the agency dropped a proposed presumption that affiliate rewards deals violate the law's yield ban, leaving existing rewards programs to case-by-case review. The rule covers national banks, federal savings associations, federal branches and nonbank firms seeking federal qualified issuer status, with a $5 million capital floor, while anti-money-laundering rules will follow in separate rulemaking with the Treasury.
Aave Backs Tokenized SpaceX Shares as Collateral With Strict Guardrails Ahead of 2.43 Billion Share Unlock
Aave risk adviser LlamaRisk has backed listing tokenized SpaceX shares, trading as SPCXc, as collateral on Aave V4's Equities Hub on Base, but only under the hub's toughest terms: a 55% collateral factor, a 6.5% maximum liquidation bonus, a 1,000 basis point risk premium and a 37,000 token supply cap worth about $5.8 million. The caution reflects SpaceX's four months of public trading history and a lock-up calendar that releases 2.43 billion shares, 84% of the current float, between October 26 and December 8, 2026. SPCXc would be collateral-only, with USDC the only borrowable asset, and larger liquidations would depend on redemptions or derivatives hedges because onchain depth is thin.
Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M
Wallets linked to the April 2026 Drift Protocol exploit sent about 18,800 ETH, worth roughly $46 million, into Tornado Cash on October 21, 2026, according to blockchain tracker Onchain Lens, taking the two-day total to 44,510 ETH, worth about $109 million. The move follows the roughly $61 million first tranche on October 20 that MABOnChain reported, and Arkham Intelligence labeled wallets still held about 56,569 ETH, worth roughly $138 million, after the latest deposits. Drift has attributed the April attack, which cost about $295 million, to a North Korean threat group, and victims are claiming through a DFX recovery token scheme that started with a pool of about $3.1 million.
France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures
France's Treasury, AMF, Banque de France and ACPR published a joint response on October 21, 2026 to the European Commission's MiCA review consultation, proposing that crypto platforms which actively connect customers to DeFi protocols should face liability for certain client losses when they fail to vet protocols or ignore known risks. The proposal would also move supervision of significant crypto firms to ESMA, lower the 15 million daily active user threshold for significant status, and rework MiCA's stablecoin categories after zero asset-referenced tokens were authorized. The Commission's report to EU lawmakers is due by June 30, 2027.
UK High Court Lets 16,000 Victims Appeal Ruling on 61,000 Seized Bitcoin in Qian Zhimin Case
The UK High Court has granted about 16,000 Chinese fraud victims permission to appeal its October 12, 2026 ruling that Chinese law governs property claims over more than 61,000 Bitcoin seized in the Qian Zhimin money laundering case, according to PANews reporting on October 21 that cited Caixin. The appeal keeps alive the victims' bid to claim a share of a stash worth about 3.8 billion pounds, after the original ruling said their claims must be tested under Chinese law rather than English property law. Lawyers at the follow-up hearing also discussed litigation costs from the earlier dispute and how individual applicants can continue or withdraw their claims.
Ether ETFs Pass $1.08B in October Outflows, Biggest Monthly Drain of 2026
U.S. spot Ether ETFs have shed $1.08 billion so far in October 2026, the biggest monthly outflow of the year and the largest since November 2025, after Tuesday added $26 million to the drain, according to SoSoValue data reported by Cointelegraph. The withdrawals have erased September's $832 million in net inflows and left year to date net inflows at about $485 million, while Ether has fallen 9.7% in October to $2,438. Bitcoin funds moved the other way at the start of the week, pulling in $527 million on Monday before adding $23 million on Tuesday.
Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets
Belgian hardware wallet maker NGRAVE disclosed on October 19, 2026 that attackers hijacked a third party push notification provider for its LIQUID companion app and sent fake security alerts to users on October 17, tricking them into entering recovery phrases on a counterfeit website and draining about $2.56 million from 70 wallets across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. NGRAVE says its ZERO hardware wallets were never compromised, and its chief executive admitted the company had absolutely and utterly failed in its most basic security duty.
Zcash Jumps 10% as NU7 Locks In Mainnet Activation for 25-Second Blocks
Zcash jumped about 10% on October 21, 2026, trading near $1,260, after developers set the mainnet activation height for NU7, the network upgrade that cuts Zcash block times from 75 seconds to 25 seconds. The activation height is the block number at which every node switches to the new rules, and NU7 pairs the threefold speedup with a Network Sustainability Mechanism that routes 60% of each block's transaction fees into a reserve paid back out over time. ZEC has gained roughly 45% in the past week and about 138% over 30 days, pushing its market capitalization back above $20 billion for the first time since 2016.
Qubic Restarts Blockchain and Opens Recovery Claims After $1.4M Wallet-Seed Hack
Qubic has restarted its blockchain and opened a recovery-claims platform after a wallet-seed vulnerability drained about $1.4 million in QU tokens from 1,404 accounts, the project said in its latest update. The network resumed processing ticks at 8:00 pm on October 19, advancing past tick 85,371,949 where it was halted on Sunday, October 18, after the project’s Computor validators approved a recovery plan and the first batch of recovered funds was returned to verified owners. Qubic says 87.1% of the stolen tokens stayed immobilized on the paused network while 12.9% went to MEXC, which froze the receiving account, and it warns that any wallet created with its web wallet before version 4.26.4, released October 19, should be treated as insecure. Affected users have until May 1, 2027 to submit claims through the project’s sole official reclaim site.
CME Logs First Trades in Bitcoin Cash and Uniswap Futures With FalconX-GSR Debut Block Trade
CME Group confirmed on October 20, 2026 that FalconX and GSR executed the first block trade in its new Bitcoin Cash and Uniswap futures, with trading now underway on the world's largest derivatives venue. The launch extends CME's single-asset crypto futures lineup to 11 tokens and makes UNI the first DeFi protocol token with standalone CME futures, in standard 10,000-UNI and micro 1,000-UNI sizes trading 24 hours a day. CME's crypto futures and options business has averaged more than 242,000 contracts a day in 2026, about $7.9 billion in notional value, with its five earlier altcoin futures this year adding nearly $2 billion in year-to-date notional.
SkyAI Sells Entire Solana Treasury, Launches $201.3M Tender Offer
SkyAI, the Nasdaq-listed company formerly known as Sharps Technology, has sold its entire Solana treasury and launched a $201.3 million cash tender offer to repurchase up to 95% of its shares and warrants, according to an October 19, 2026 SEC filing. The company held $223.8 million in cash and zero SOL as of October 16, reversing a strategy that at its peak held more than 2 million SOL bought for over $400 million. The $3-per-share offer expires October 29, but major shareholder Bastion Trading, with about 9.99% of the stock, is refusing to participate and wants at least $3.50 plus an independent review of the SOL sales.
Ireland Moves Another 500 BTC From Clifton Collins' Seized Wallets to Coinbase Prime
A wallet linked to convicted Irish drug trafficker Clifton Collins moved 500 BTC, worth about $41.5 million, to Coinbase Prime on October 20, 2026, the fifth 500-BTC tranche recovered from his long-thought-lost Bitcoin fortune this year. Blockchain intelligence firm Arkham Intelligence flagged the transfer; about 2,500 BTC have now moved from the wallets in 2026, while roughly 3,500 BTC worth about $290 million remain. Collins bought about 6,000 BTC in 2011 and 2012 at roughly $5 each, printed the private keys on paper and hid them in a fishing rod case, and lost access in 2017. Ireland's Criminal Assets Bureau, with help from Europol's European Cybercrime Centre, began opening the wallets in March 2026.
Stablecoin Transfers Quadruple to $891B in Q3 as U.S. Banks Test the Rails, Coinbase Study Finds
Research conducted for Coinbase by The Block Pro Research found that adjusted stablecoin transfer volume hit $891 billion in the third quarter of 2026, more than four times the level of early 2023, with over $400 million moving per hour and 73% of volume settling outside U.S. banking hours. The study, titled The Always-On Dollar, says seven of the ten largest U.S. banks have tested stablecoins or tokenized deposits for settlement, with the remaining three announcing plans to do so, while 293 million blockchain addresses now hold stablecoins, more than the combined card bases of American Express and Discover.
ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds
Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service on Hyperliquid Core, are tied to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT traced more than $20 million in inflows above a $10,000 review threshold to ransomware payments, cryptocurrency exploits, malware and social engineering attacks, including the September 2026 incidents at DCENT Wallet, Fetch.ai and Axelar, plus an October exploit on the Gamdom gambling platform. He also alleged the service's operator sourced Monero liquidity through KuCoin, identifying more than 3,000 deposits from associated addresses.