ZachXBT Challenges CoinDCX Account, Says $15.8M in Deposits Went Unaccounted For
Published October 22, 2026, 9:15 PM PKT. Based on blockchain investigator ZachXBT post on X on October 22, 2026, quoted verbatim by crypto.news (primary source), and reporting by crypto.news, CryptoTimes and CoinTime on October 22, 2026 (secondary sources), with the original October 21 movements and CoinDCX October 22 denial as reported by CryptoBriefing and CoinGabbar. This is a follow-up to MABOnChain article 324, published at 3:15 PM PKT today, which reported CoinDCX denial of a new hack; that article did not carry ZachXBT rebuttal, which is the new development reported here. ZachXBT claims are allegations based on transaction history he cites, not independently confirmed findings, and no new breach or customer loss has been independently confirmed.
The CoinDCX dispute escalated on October 22, 2026, when blockchain investigator ZachXBT publicly challenged the exchange account of the $16 million in USDT transfers flagged a day earlier. CoinDCX had said the wallets involved were created in January 2025, were compromised in its July 2025 hack, and had not been used by the exchange since, calling circulating claims misleading and insisting that user funds are safe. ZachXBT said that account does not fit the transaction history of one deposit address, TQKJQ, on the TRON blockchain. "CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet," ZachXBT wrote, according to crypto.news. "Meaning $15.8M in user deposits was unaccounted for by your team." The post, published on X on October 22, 2026, turns a dispute about one night of transfers into a dispute about ten months of wallet history, and it is the part of the story CoinDCX had not publicly answered at the time of reporting.
The TQKJQ address and the April and May sweeps
The specific claim is what makes the rebuttal hard to dismiss with a general denial. ZachXBT did not only argue that an old address moved funds on October 21. He named a deposit address, TQKJQ, and said a liquidity provider kept using it for about 10 months after the July 2025 incident, with the address still receiving user deposits and gas transfers as recently as April and May 2026, and with those funds sweeping to wallets publicly identified as CoinDCX current hot wallets, crypto.news reported. A screenshot accompanying his post showed a transfer of roughly 15.819 million USDT on October 21, alongside several smaller USDT and TRX transactions during May 2026, according to crypto.news. CoinTime reported the same sequence: the address kept receiving deposits and gas in April and May 2026 and transferred funds to CoinDCX current public hot wallet. If the timeline holds, it contradicts the central plank of CoinDCX explanation, which is that the compromised addresses were simply abandoned wallets being reused by attackers. An abandoned wallet does not receive fresh deposits and sweep them to a current hot wallet ten months later. That is why the TQKJQ history, rather than the October 21 total alone, is the development to watch.
The $15.8 million gap ZachXBT alleges
ZachXBT figure needs careful handling, because it is not the same number as the October 21 transfers, and the two figures answer different questions. The October 21 movements flagged by Darcy, an executive at blockchain security firm Salus, totaled approximately 15.99 million USDT and 5,783.81 TRX, with the largest single transaction at 15,819,002 USDT moving to a TRON address that then split the funds onward toward deposit addresses at Binance, OKX and Gate, according to CryptoBriefing. The $15.8 million figure in ZachXBT post is a separate allegation: the amount of user deposits he says went unaccounted for by CoinDCX team over the period the TQKJQ address stayed in use. The closeness of the two figures, $15.8 million against $15.99 million, is coincidental in the reporting, and this article does not merge them into one loss. Crypto.news also noted the limits of the evidence: the screenshots cited do not independently establish ownership of every wallet, the purpose of the transactions, or whether the reported amount represents a confirmed customer loss. ZachXBT further questioned the reliability of Indian centralized exchanges more broadly, referencing prior issues at WazirX and BitBNS, according to CryptoTimes, but that broader criticism is his opinion, not a finding about CoinDCX.
What CoinDCX has and has not answered
CoinDCX position, as stated on October 22, 2026, has three parts, and only the first two are direct answers. First, co-founder and CEO Sumit Gupta wrote on X that CoinDCX wallets are not breached and urged users not to spread rumors, saying the addresses tagged by Arkham Intelligence used to belong to CoinDCX before the July 2025 hack, crypto.news reported. Second, the exchange said it had checked its current operational and customer addresses and found no transfers from those wallets to the addresses in the allegations, and pointed to its publicly available proof of reserves information. Third, Gupta said the team was continuing to investigate and would release further information through official channels. What is missing, at the time of reporting, is a reconciliation of the specific TQKJQ transaction history ZachXBT cited with the claim that the addresses were unused since July 2025. Crypto.news reported that CoinDCX had not publicly reconciled that specific history with its explanation when its article was published. Until the exchange addresses the April and May 2026 sweeps directly, or ZachXBT evidence is independently verified, the public record contains two incompatible accounts of the same wallets, and readers should treat neither as settled.
What remains unproven
Three things remain unproven, and keeping them separate is what keeps this story accurate. No new security breach has been independently confirmed: the transfers themselves are visible on chain, but whether they were unauthorized, and whether the receiving wallets belong to an attacker, has not been independently established, as crypto.news noted about the original Darcy findings. No customer loss has been confirmed: CoinDCX says user funds are safe and trading continues as usual, and no regulator or auditor has contradicted that. And the ownership question is unresolved: Arkham Intelligence labels identify the addresses as CoinDCX wallets, but a label is not proof of current control, a point the earlier reporting itself flagged. The July 2025 context is settled history, not present allegation: attackers stole approximately $44 million from an internal liquidity account used by the exchange, CoinDCX covered the losses through its treasury, and the company later offered a recovery bounty of up to 25 percent of recovered assets, capped at $11 million, according to crypto.news. The open question is narrower and more consequential for trust: whether a deposit address compromised in that incident kept handling customer deposits into 2026, and if so, where those deposits went. That is the question CoinDCX investigation now has to answer.
This article is news reporting and is not investment advice.
Sources
- ZachXBT post on X, October 22, 2026, quoted verbatim by crypto.news (primary source)
- crypto.news, CoinDCX denies second hack claims as ZachXBT questions wallet activity (October 22, 2026), secondary source
- CryptoTimes, ZachXBT Alleges $15.8M in Unaccounted CoinDCX Deposits, Questions Indian Exchange Trust (October 22, 2026), secondary source
- CoinTime, CoinDCX Denies New Security Breach, Emphasizes Involved Wallet is a Historically Compromised Address (October 22, 2026), secondary source
- CryptoBriefing, CoinDCX rejects hack claims after $16 million in USDT transfers reported (October 22, 2026), secondary source
- CoinDCX posts on X, October 22, 2026, as reported by CryptoBriefing and CoinGabbar (exchange denial, secondary record)
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Fireblocks Denies Report of $2.5 Billion Visa Acquisition Talks
Crypto custody firm Fireblocks said on October 22, 2026 that reports of a $2.5 billion acquisition by Visa are not true at present time, pushing back the same day on an Axios report that Visa was in late-stage talks to buy the company. The reported price would value Fireblocks about 69 percent below the $8 billion valuation from its January 2022 Series E round, when it raised $550 million. Visa declined to comment on the speculation, and no deal, terms or timetable has been announced by either company.
Central Bank of Ireland Fines Coinbase Ireland 3.25 Million Euros Over Customer Fund Safeguarding Failures
The Central Bank of Ireland has fined Coinbase Ireland Limited 3,252,618 euros for breaching customer-fund safeguarding and outsourcing obligations between November 2020 and August 2025, the regulator announced on October 22, 2026, after a settlement reached on October 21, 2026. The regulator said the firm left its designated safeguarding account underfunded for lengthy periods, with daily shortfalls reaching 5.2 million euros in 2024, while Coinbase said it self-reported the issues in January 2024, has fully fixed them, and that no customer lost money or lost access to funds. The sanctions, a reprimand plus the fine, take effect only once the High Court of Ireland confirms them.
SoFi Launches First Bank-Issued Tokenized Deposit for Consumers at 4.40% APY
SoFi Technologies said on October 22, 2026 that it has launched SoFi Earn (SOFIE), which it calls the first and only national bank-issued tokenized deposit for consumers. Each SOFIE represents $1 on deposit at SoFi Bank, earns a variable 4.40% annual percentage yield, and is covered by FDIC insurance up to applicable limits. Members can convert SOFIE one for one into the SoFiUSD stablecoin to buy crypto in the SoFi app or move funds over blockchain rails around the clock, and the product is rolling out to SoFi Crypto members now through November 2026.
CoinDCX Denies New Hack as $16M in USDT Moves From Old Compromised Wallets
Indian exchange CoinDCX said on October 22, 2026 that about 15.99 million USDT and 5,783.81 TRX that moved on October 21 came from old wallet addresses created in January 2025 and compromised in its July 2025 hack, not from a new breach, after blockchain security researcher Darcy flagged the transfers from addresses labeled as CoinDCX hot wallets and deposit addresses to a single TRON address. CoinDCX said user funds are safe and trading continues as usual, while the receiving address split the funds onward toward deposit addresses at Binance, OKX and Gate, and no independent confirmation of the old wallet link has yet appeared.
NEAR Jumps 7% as Business Launch Targets Private Crypto Treasuries
NEAR rose about 7% to $5.31 on October 21, 2026, a day after NEAR Protocol launched NEAR Business, a private treasury platform that lets teams pay staff and vendors, swap assets and allocate capital across more than 35 blockchains while keeping payroll and treasury balances confidential from the market but legible to auditors, according to NEAR and Stocktwits reporting. The move also landed as a House of Stake vote opened on cutting annual issuance from 2.5% to 1.6% over 24 months, and as NEAR Intents passed $32 billion in cumulative volume in the third quarter of 2026.
Solana Alpenglow Goes Live on Mainnet in Biggest Consensus Switch Since Launch
Solana has activated Alpenglow, its first major consensus upgrade, on mainnet on October 21, 2026, replacing the TowerBFT voting system it has used since launch with a new protocol called Votor that targets transaction finality in about 150 milliseconds, down from roughly 12.8 seconds. CryptoBreaking, citing the Solana Foundation Alpenglow dashboard, put activation at about 1:54 pm UTC, in epoch 1064, while the dashboard reading at press time showed finality of about 6.6 seconds and throughput of about 4,721 transactions per second, a reminder that the 150 millisecond figure is a target to converge toward, not an instant day one measurement. The second Alpenglow phase, Rotor, which would replace the Turbine block propagation system, does not activate with Votor and remains unscheduled.
Standard Chartered Signs Definitive Deal to Take Full Ownership of Zodia Custody
Standard Chartered has signed definitive agreements to acquire 100% of Zodia Custody, the institutional digital asset custodian it helped create, turning a takeover first agreed in principle in May into a binding deal. Standard Chartered I H Limited will acquire 100% of Zodia Custody UK Limited, the parent of Zodia's regulated operating entities in Singapore, Hong Kong, Australia, the United Arab Emirates and Luxembourg, subject to regulatory approvals and customary closing conditions, with financial terms undisclosed. After completion, Zodia's custody business joins the bank's Securities Services division, while its software and professional services assets move to Zodia Solutions, a new independent entity under SC Ventures backed by bank investors including Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD.
OCC Finalizes First GENIUS Act Stablecoin Rule, Sets January 18, 2027 Start Date
The U.S. Office of the Comptroller of the Currency has issued the first final rule implementing the GENIUS Act, setting reserve, redemption and capital standards for payment stablecoin issuers under its jurisdiction, effective January 18, 2027. Issuers must hold reserves at least equal to their outstanding stablecoins and generally redeem within two business days, while the agency dropped a proposed presumption that affiliate rewards deals violate the law's yield ban, leaving existing rewards programs to case-by-case review. The rule covers national banks, federal savings associations, federal branches and nonbank firms seeking federal qualified issuer status, with a $5 million capital floor, while anti-money-laundering rules will follow in separate rulemaking with the Treasury.
Aave Backs Tokenized SpaceX Shares as Collateral With Strict Guardrails Ahead of 2.43 Billion Share Unlock
Aave risk adviser LlamaRisk has backed listing tokenized SpaceX shares, trading as SPCXc, as collateral on Aave V4's Equities Hub on Base, but only under the hub's toughest terms: a 55% collateral factor, a 6.5% maximum liquidation bonus, a 1,000 basis point risk premium and a 37,000 token supply cap worth about $5.8 million. The caution reflects SpaceX's four months of public trading history and a lock-up calendar that releases 2.43 billion shares, 84% of the current float, between October 26 and December 8, 2026. SPCXc would be collateral-only, with USDC the only borrowable asset, and larger liquidations would depend on redemptions or derivatives hedges because onchain depth is thin.
Drift Exploiter Sends Another $46M in ETH to Tornado Cash, Two-Day Total Hits $109M
Wallets linked to the April 2026 Drift Protocol exploit sent about 18,800 ETH, worth roughly $46 million, into Tornado Cash on October 21, 2026, according to blockchain tracker Onchain Lens, taking the two-day total to 44,510 ETH, worth about $109 million. The move follows the roughly $61 million first tranche on October 20 that MABOnChain reported, and Arkham Intelligence labeled wallets still held about 56,569 ETH, worth roughly $138 million, after the latest deposits. Drift has attributed the April attack, which cost about $295 million, to a North Korean threat group, and victims are claiming through a DFX recovery token scheme that started with a pool of about $3.1 million.
France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures
France's Treasury, AMF, Banque de France and ACPR published a joint response on October 21, 2026 to the European Commission's MiCA review consultation, proposing that crypto platforms which actively connect customers to DeFi protocols should face liability for certain client losses when they fail to vet protocols or ignore known risks. The proposal would also move supervision of significant crypto firms to ESMA, lower the 15 million daily active user threshold for significant status, and rework MiCA's stablecoin categories after zero asset-referenced tokens were authorized. The Commission's report to EU lawmakers is due by June 30, 2027.
UK High Court Lets 16,000 Victims Appeal Ruling on 61,000 Seized Bitcoin in Qian Zhimin Case
The UK High Court has granted about 16,000 Chinese fraud victims permission to appeal its October 12, 2026 ruling that Chinese law governs property claims over more than 61,000 Bitcoin seized in the Qian Zhimin money laundering case, according to PANews reporting on October 21 that cited Caixin. The appeal keeps alive the victims' bid to claim a share of a stash worth about 3.8 billion pounds, after the original ruling said their claims must be tested under Chinese law rather than English property law. Lawyers at the follow-up hearing also discussed litigation costs from the earlier dispute and how individual applicants can continue or withdraw their claims.
Ether ETFs Pass $1.08B in October Outflows, Biggest Monthly Drain of 2026
U.S. spot Ether ETFs have shed $1.08 billion so far in October 2026, the biggest monthly outflow of the year and the largest since November 2025, after Tuesday added $26 million to the drain, according to SoSoValue data reported by Cointelegraph. The withdrawals have erased September's $832 million in net inflows and left year to date net inflows at about $485 million, while Ether has fallen 9.7% in October to $2,438. Bitcoin funds moved the other way at the start of the week, pulling in $527 million on Monday before adding $23 million on Tuesday.
Fake Ngrave Security Alerts Drain $2.56M From 70 Wallets
Belgian hardware wallet maker NGRAVE disclosed on October 19, 2026 that attackers hijacked a third party push notification provider for its LIQUID companion app and sent fake security alerts to users on October 17, tricking them into entering recovery phrases on a counterfeit website and draining about $2.56 million from 70 wallets across four blockchains. Bitcoin accounted for $1.77 million of the losses, followed by $454,000 in XRP, $316,000 in Ethereum based assets and $18,000 in Stellar. NGRAVE says its ZERO hardware wallets were never compromised, and its chief executive admitted the company had absolutely and utterly failed in its most basic security duty.
Zcash Jumps 10% as NU7 Locks In Mainnet Activation for 25-Second Blocks
Zcash jumped about 10% on October 21, 2026, trading near $1,260, after developers set the mainnet activation height for NU7, the network upgrade that cuts Zcash block times from 75 seconds to 25 seconds. The activation height is the block number at which every node switches to the new rules, and NU7 pairs the threefold speedup with a Network Sustainability Mechanism that routes 60% of each block's transaction fees into a reserve paid back out over time. ZEC has gained roughly 45% in the past week and about 138% over 30 days, pushing its market capitalization back above $20 billion for the first time since 2016.
Qubic Restarts Blockchain and Opens Recovery Claims After $1.4M Wallet-Seed Hack
Qubic has restarted its blockchain and opened a recovery-claims platform after a wallet-seed vulnerability drained about $1.4 million in QU tokens from 1,404 accounts, the project said in its latest update. The network resumed processing ticks at 8:00 pm on October 19, advancing past tick 85,371,949 where it was halted on Sunday, October 18, after the project’s Computor validators approved a recovery plan and the first batch of recovered funds was returned to verified owners. Qubic says 87.1% of the stolen tokens stayed immobilized on the paused network while 12.9% went to MEXC, which froze the receiving account, and it warns that any wallet created with its web wallet before version 4.26.4, released October 19, should be treated as insecure. Affected users have until May 1, 2027 to submit claims through the project’s sole official reclaim site.
CME Logs First Trades in Bitcoin Cash and Uniswap Futures With FalconX-GSR Debut Block Trade
CME Group confirmed on October 20, 2026 that FalconX and GSR executed the first block trade in its new Bitcoin Cash and Uniswap futures, with trading now underway on the world's largest derivatives venue. The launch extends CME's single-asset crypto futures lineup to 11 tokens and makes UNI the first DeFi protocol token with standalone CME futures, in standard 10,000-UNI and micro 1,000-UNI sizes trading 24 hours a day. CME's crypto futures and options business has averaged more than 242,000 contracts a day in 2026, about $7.9 billion in notional value, with its five earlier altcoin futures this year adding nearly $2 billion in year-to-date notional.
SkyAI Sells Entire Solana Treasury, Launches $201.3M Tender Offer
SkyAI, the Nasdaq-listed company formerly known as Sharps Technology, has sold its entire Solana treasury and launched a $201.3 million cash tender offer to repurchase up to 95% of its shares and warrants, according to an October 19, 2026 SEC filing. The company held $223.8 million in cash and zero SOL as of October 16, reversing a strategy that at its peak held more than 2 million SOL bought for over $400 million. The $3-per-share offer expires October 29, but major shareholder Bastion Trading, with about 9.99% of the stock, is refusing to participate and wants at least $3.50 plus an independent review of the SOL sales.
Ireland Moves Another 500 BTC From Clifton Collins' Seized Wallets to Coinbase Prime
A wallet linked to convicted Irish drug trafficker Clifton Collins moved 500 BTC, worth about $41.5 million, to Coinbase Prime on October 20, 2026, the fifth 500-BTC tranche recovered from his long-thought-lost Bitcoin fortune this year. Blockchain intelligence firm Arkham Intelligence flagged the transfer; about 2,500 BTC have now moved from the wallets in 2026, while roughly 3,500 BTC worth about $290 million remain. Collins bought about 6,000 BTC in 2011 and 2012 at roughly $5 each, printed the private keys on paper and hid them in a fishing rod case, and lost access in 2017. Ireland's Criminal Assets Bureau, with help from Europol's European Cybercrime Centre, began opening the wallets in March 2026.
Stablecoin Transfers Quadruple to $891B in Q3 as U.S. Banks Test the Rails, Coinbase Study Finds
Research conducted for Coinbase by The Block Pro Research found that adjusted stablecoin transfer volume hit $891 billion in the third quarter of 2026, more than four times the level of early 2023, with over $400 million moving per hour and 73% of volume settling outside U.S. banking hours. The study, titled The Always-On Dollar, says seven of the ten largest U.S. banks have tested stablecoins or tokenized deposits for settlement, with the remaining three announcing plans to do so, while 293 million blockchain addresses now hold stablecoins, more than the combined card bases of American Express and Discover.
ZachXBT Says 87% of FreedomXMR Inflows on Hyperliquid Are Illicit Funds
Blockchain investigator ZachXBT said on October 20, 2026 that more than 87% of the funds flowing into FreedomXMR, a centralized exchange service on Hyperliquid Core, are tied to illicit activity, according to reporting by crypto.news and PANews based on his published investigation. ZachXBT traced more than $20 million in inflows above a $10,000 review threshold to ransomware payments, cryptocurrency exploits, malware and social engineering attacks, including the September 2026 incidents at DCENT Wallet, Fetch.ai and Axelar, plus an October exploit on the Gamdom gambling platform. He also alleged the service's operator sourced Monero liquidity through KuCoin, identifying more than 3,000 deposits from associated addresses.