CoinDCX Absorbs Losses, Credits Users After Failed Sweep of Hacked Deposit Addresses

Introduction

CoinDCX, one of India’s leading cryptocurrency exchanges, announced that it has credited users who continued to deposit funds to wallet addresses compromised in the July 2025 hack. The exchange said a routine sweep designed to retrieve those stray deposits failed for a period, resulting in operational losses that CoinDCX has chosen to absorb.

What happened?

In July 2025, hackers accessed an internal CoinDCX account and moved roughly $44 million. In response, the exchange deprecated the affected deposit addresses and warned customers to stop using them. Normally, any funds that still landed at those addresses would be swept into a secure hot wallet. On October 22, 2026, CoinDCX disclosed that the sweep process experienced a temporary breakdown. While the exact duration and the number of affected users were not disclosed, the exchange confirmed that it has credited the impacted accounts and will cover the losses itself.

Community reaction and on‑chain activity

The announcement coincided with renewed scrutiny of the TQKJQ wallet, which had been linked to large USDT movements after the hack. On‑chain data showed a transfer of 15.8 million USDT on October 21, 2026, followed by rapid redistribution. Although CoinDCX did not confirm whether this specific transfer was part of the losses it absorbed, the exchange’s post referenced a “further update on the TQKJQ wallet on‑chain activity.”

CoinDCX co‑founder Sumit Gupta later clarified that the flagged addresses dated back to January 2025 and were not indicative of a new breach. Independent analyst ZachXBT suggested that the TQKJQ wallet continued sweeping user deposits into CoinDCX’s hot wallet through early 2026, but the exchange has not verified those figures.

What users should do next

CoinDCX reiterated its standard security advice:

• Verify deposit addresses directly in the CoinDCX app or on the official website before sending funds.
• Avoid deprecated addresses that the exchange has officially retired.
• Understand liability limits; most exchanges do not assume responsibility for deposits sent to incorrect or outdated addresses.

The exchange has not indicated whether it will continue to credit deposits sent to the deprecated wallets beyond the current batch, so users should treat the recent reimbursements as a one‑time remediation.

Practical takeaways

1. Stay vigilant – Always double‑check the destination address displayed in the platform you are using.
2. Monitor official channels – Exchanges typically announce address changes via in‑app notifications, email, or verified social media accounts.
3. Keep records – Maintaining transaction receipts can simplify dispute resolution if a similar issue arises.
4. Diversify storage – Consider moving long‑term holdings to personal cold wallets rather than keeping large balances on exchanges.

By promptly crediting affected users and absorbing the losses, CoinDCX aims to restore confidence after a high‑profile security incident. However, the episode underscores the importance of rigorous address verification and the need for exchanges to maintain robust, transparent sweep mechanisms.

--- This article is based on publicly available statements from CoinDCX and on‑chain data. No new quotations or undisclosed figures have been introduced.