CoinDCX review: Wallet Transfer Failures and Deprecated Address Handling

CoinDCX faced renewed attention in October 2026 after on-chain analysts tracked roughly 16 million USDT moving from older TRON addresses previously flagged in a 2025 breach. The exchange described the transfers as the result of a failed automated sweep on deprecated deposit addresses rather than a new intrusion into active systems.

Customer assets held in segregated cold wallets showed no signs of direct compromise during either incident. Trading continued without interruption as of October 24, 2026, and the platform remains ISO 27001:2022 certified with an investor protection fund in place.

CoinDCX wallet incident background and 2025 breach

In July 2025, approximately 44 million dollars in USDT and USDC left an internal operational account through a server breach or social engineering attack. CoinDCX stated that customer deposits remained untouched because they sat in separate cold storage. The company covered the loss from treasury reserves, notified Indian authorities, and introduced a bug bounty program.

Blockchain records show the affected addresses were later marked as deprecated. Some of those same addresses continued to receive deposits for months afterward, according to public transaction data. ZachXBT and other investigators noted activity on at least one address as late as April and May 2026, which raised questions about the completeness of the deprecation process.

The exchange maintains that all post-July 2025 deposits on legacy addresses were swept into operational wallets under its control. Exact reconciliation of every deposit has not been published publicly.

October 2026 outflows and exchange response

Between October 21 and 23, investigators flagged 15.99 million USDT plus several thousand TRX leaving roughly forty TRON addresses tied to CoinDCX. The funds moved to a new address before portions reached deposits on Binance, OKX, and Gate.io. Tether froze about 2.21 million dollars of the traced amount.

CoinDCX initially denied any active breach and later confirmed that an automated sweep process had failed to capture deposits still arriving at old addresses. The failure was discovered on the morning of October 22. The exchange absorbed the resulting operational losses and credited affected user accounts.

Company statements emphasized that current central and user deposit addresses, along with cold-stored customer assets, remained unaffected. Users were reminded to verify deposit addresses through the official app or website before sending funds. No widespread reports of uncredited customer withdrawals emerged after the event.

Practical steps for CoinDCX users

Verify every deposit address in the CoinDCX app or on the official site immediately before each transfer. Legacy addresses that predate July 2025 should no longer be used.

• Enable all available account security features, including two-factor authentication tied to an authenticator app rather than SMS.
• Monitor official CoinDCX channels for updates on address deprecation and any further reconciliation results.
• Keep records of transaction hashes when moving larger amounts, especially on the TRON network.

The platform holds FIU-IND registration and reports an investor protection fund of approximately 57 crore rupees. Mixed user reviews on forums cite occasional support delays, yet recent app store ratings remain above 4.5. Ongoing on-chain analysis and potential Tether-assisted tracing may clarify remaining discrepancies between reported losses and on-chain flows.