blockintAI · Research blog

$16M Left CoinDCX's Old Tron Addresses in One Day. Tether Has Now Frozen $2.2M of It

BlockintAI · 2026-10-24T20:00:00.000Z

BlockintAI research. Balances and freeze status were re-checked on Friday, October 23, 2026, at about 7:05 AM Central Time (CT), using public TronGrid data and the USDT contract's own blacklist records. Times are CT unless marked UTC. Amounts are USDT on Tron.

On Wednesday, October 21, about 15.99 million USDT left Tron addresses tied to CoinDCX, one of India's largest crypto exchanges. It all went to one new address. Within about 15 hours that address had passed every dollar on, and from there the money spread into exchange deposit addresses and fresh wallets.

CoinDCX's first answer was that the reports were "misleading." A few hours later it said a sweeping process on retired deposit addresses "failed" for a period and that the "operational losses" were absorbed by the exchange.

On Thursday evening, Tether froze part of the money. At 5:45:39 PM CT on October 22, nine Tron addresses were added to the USDT blacklist in the same block. Together they held 2,212,850.29 USDT. We traced each of those nine addresses back to the receiving address on-chain. That is about 14% of what left. Most of the rest had already reached exchanges or wallets that are still free to move.

Key facts
What happened 15,991,414.31 USDT and about 5,789 TRX moved from Tron addresses linked to CoinDCX to TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
When First inflow Oct 21, 7:33 AM CT (12:33 UTC). The largest transfer, 15,819,002 USDT, came at 10:35:54 AM CT (15:35:54 UTC). The address had sent everything on by 10:22 PM CT (03:22 UTC Oct 22)
Where it came from 46 USDT transfers from 41 addresses. Almost all of it came from one deposit address, TQKJQr…qWUy
First hops 7,135,881.31 USDT to TMJMTCvtPgMRQmLBYUTmdwfEozoveccUjq, 4,000,000 to TFaHkHcMGWLnnBCaGVpHBHufb1DNNHbadh, 3,000,000 to TUNxeav4BWVoFGGaE97ygHkKYdKLJTHkbU, and the rest in smaller transfers
CoinDCX's account "Old wallet addresses" compromised in July 2025 and deprecated; a sweep "failed" for a period; losses absorbed; users credited
Frozen Oct 22, 5:45:39 PM CT (22:45:39 UTC): nine addresses blacklisted by Tether, holding 2,212,850.29 USDT
Not frozen (Oct 23, 7:05 AM CT) At least 29,955.87 USDT still sat in two more downstream addresses
BlockintAI report CoinDCX: about $16M USDT moved from its old Tron deposit addresses to TAg6SZ1Hhg…

What happened on October 21

CoinDCX says its "operational process is designed for regular sweeping" of deposits made to its old addresses. Sweeping means moving deposits from individual deposit addresses into a main wallet, with the network fee paid in TRX from a separate wallet.

On Wednesday morning, that system's addresses began paying someone else. The first transfer to TAg6SZ1Hhg… arrived at 7:33 AM CT from TFLxNH…znGd, which Darcy, who lists himself as CMO of the security firm Salus and posted about the transfers on X, describes as a CoinDCX hot wallet listed in its proof of reserves. Through the day, dozens of small deposit addresses followed.

Then, at 10:35:54 AM CT, one deposit address, TQKJQr…qWUy, sent 15,819,002 USDT in a single transfer (transaction). That one payment is about 99% of the total.

Our count from public TronGrid data: TAg6SZ1Hhg… received 15,991,414.31 USDT in 46 transfers from 41 addresses on October 21. It sent all of it on in 18 transfers, the first at 12:05 PM CT and the last at 10:22 PM CT. Most went to three new addresses: TMJMTC… (7.14M), TFaHkH… (4M) and TUNxea… (3M). All three received their first USDT that day.

The earliest public post we found was Darcy's, at 12:30 AM CT on Thursday, October 22, about 14 hours after the big transfer.

Two accounts of the same addresses

CoinDCX's. Co-founder Sumit Gupta replied on X at 3:10 AM CT that "CoinDCX wallets are not breached." He said the addresses "were generated in Jan 2025 and were compromised in the previous hack in July 2025," and that none of the exchange's current addresses "have sent money to these old addresses." Four minutes later the company's account called the claims "misleading," saying the addresses "have not been used by CoinDCX since" July 2025.

At 6:47 AM CT CoinDCX posted a longer update. It said users had kept depositing to deprecated addresses despite warnings, that its "operational process is designed for regular sweeping of any such deposits," and that "for a particular period, this sweeping process failed, which got identified today morning." It said the resulting "operational losses" were "absorbed by CoinDCX," that affected users were "duly credited," and that current wallets were not affected. CoinDCX was hit in July 2025 for about $44 million, as CoinDesk and Moneycontrol noted in their coverage.

The researchers'. ZachXBT replied that TQKJQ "was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet." The researcher Tay wrote that "all the wallets drained today (yesterday) were actively in use by CoinDCX in 2026."

Public TronGrid data adds some detail on TQKJQr…qWUy. It received 756 USDT transfers totalling 101,259,817.27 USDT from March 27, 2025 onward, and forwarded 610 of them (85,440,815.27 USDT) to a single address, TU7BbA…, the last on May 4, 2026. Its balance before October 21 was exactly 15,819,002 USDT. Separately, TFLxNH…znGd sent it 15 TRX 429 times between March 27, 2025 and May 4, 2026. We don't know who controls TU7BbA….

The chain can't settle every part of this argument. It shows which addresses signed which transfers. It doesn't show who held the keys, or how CoinDCX accounted for those deposits in its own books. What the public record does support is narrower: the addresses that paid TAg6SZ1Hhg… include TFLxNH…znGd, which Darcy and ZachXBT describe as a CoinDCX wallet and which was sending TQKJQr…qWUy small TRX transfers until May 4, 2026, and TQKJQr…qWUy itself, which took in and forwarded USDT until May 2026.

Where the money went

From the three big first hops, the money split quickly. Two researchers who traced it, Darcy and AMLBot, agree on the main destinations but not the totals. AMLBot says the funds were deposited to OKX (about $5.5M), Binance (about $2.8M) and Gate (about $1.4M), roughly $9.7 million, and that "a large share went through unidentified services." Darcy's count is lower, about $8.9 million: Binance 2,020,943 USDT, OKX 5,465,933 plus a separate 50,000, and Gate 1,392,199. We haven't independently verified either count.

Darcy also wrote that some funds went to addresses associated with two other services he names. We haven't found a free public label that confirms or rules that out, so treat it as his claim.

On Thursday morning (9:46 AM CT), AMLBot said about $2.4 million was still parked across fresh addresses, including two holding about $720,000 and $665,000, and that none was frozen yet.

Those balances didn't stay put. Between 8:08 AM and 1:40 PM CT on Thursday, the largest ones each moved one or two more hops into brand-new addresses:

None of those new addresses sent anything to an exchange before the freeze.

The freeze

Tether can blacklist any address on its USDT contract on Tron, which stops that address from sending USDT. Each blacklisting is a public transaction that emits an AddedBlackList event.

At 22:45:39 UTC on October 22 (5:45:39 PM CT), the USDT contract recorded nine AddedBlackList events in one block. We read the blacklist status and balance of each address directly from the USDT contract at about 7:05 AM CT on Friday:

Address USDT held How it connects to TAg6SZ1Hhg…
TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a 664,939.48 TUNxea → TEZxfx → TBSCau → TMHURk → here
TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG 400,994.82 TUNxea → TTb34r → TZJ3RU → TQPyFb → here
TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs 319,000.00 same route as above, second branch from TQPyFb
TX9yK8i4v1M9dKbpVtTwLecQYaEkX3YwMQ 310,000.00 TUNxea → TM28xE → THrBCA → here
TWdVwEJCNZZ3JEh4dv98DoziCaeXYuSfdE 298,467.01 TUNxea → here (received 500,000 at 10:04 PM CT Oct 21)
TLG1DowsW7BzXji7yTpPwc98P2y4cLx49r 134,618.56 from TWdVwE (200,000) and, via TTb34r → TR2Ut7 → TLUCYd, a further 200,445
TM5vyaahnPacnBzNR3HNp19NrBbHLNbf3V 35,597.52 second branch from THrBCA
TJdrjZKzcbXkmGy3Sm9RQNK5QGRMK93jf5 29,232.91 TMJMTC → TJ8eUc → here (an older wallet: USDT activity since Aug 2026)
TVK3dRqe9Aqfcdxvp9fWScAMdGmDBHyG6L 20,000.00 directly from TAg6SZ1Hhg… (10:12 PM CT Oct 21)
Total 2,212,850.29

The blockchain analytics firm Arisk reported the same freeze: "approximately 2,212,900 USDT" across nine addresses, all added "in the same block." ZachXBT wrote on Thursday morning (8:42 AM CT), hours before this freeze, that he "still helped freeze 6 figures for CoinDCX"; we can't tell which addresses he meant. We found no public statement from Tether about the freeze, and the chain doesn't show who asked for it.

What the freeze missed. At our Friday check, two downstream addresses that weren't frozen still held USDT: TH5kFHYHzDQVWHs85hVhBM7VfFmet7UfpG (20,000, received from TTb34r at 1:24 AM CT on October 22) and TTb34rZMrTi3gHNKeFLg1qaaTqXsdyG48v itself (9,955.87). Two other transfers left the traced set before the freeze: TLG1Do… sent 265,810 USDT on to TMav76…, an older, busy wallet, and TUNxea… sent 500,000 USDT to TURGxx…, which wasn't among the nine. Everything that reached OKX, Binance and Gate deposit addresses is now in those exchanges' hands. Only they can say whether the accounts were stopped.

The receiving side today

At our Friday check, TAg6SZ1Hhg… and the three first-hop addresses held essentially no USDT (TFaHkH… had 100 left). None of them is on the USDT blacklist, and none of the addresses in this post appears on the OFAC sanctions list. The money has moved on from them, so a freeze there would no longer catch anything.

That is the pattern in most stablecoin thefts. Issuers can freeze only what is still sitting in an address when they act. Here, the bulk of the money was in exchange deposit addresses or unnamed busy wallets before anyone outside the exchange noticed. Most of the $2.2 million that was caught sat in addresses that were new on October 21 or 22. One of the nine, TJdrjZ…, is an older wallet with USDT activity since August 2026.

What CoinDCX users and other exchange customers can take from it

  • Always copy a fresh deposit address from the exchange's app or website. CoinDCX's own explanation turns on customers paying old, "deprecated" addresses. If an exchange tells you an address is retired, stop using it, and delete it from your saved addresses.
  • If a deposit never showed up, open a ticket with the transaction hash. The chain proves you sent it. The exchange's books decide whether you're credited.
  • Watch the issuer's blacklist, not just the headlines. USDT and USDC freezes are public. Anyone can check an address's status on the token contract or on Tronscan, and a freeze is often the first hard sign that investigators and the issuer are acting.
  • Report it. If you lost funds in this or any exchange incident, report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov, and file a report at blockint.ai with your addresses and transaction IDs. It's free, and anonymous reports are accepted.

For an earlier Tron theft where Tether froze funds within hours, see our post on the SquidSquad theft on BNB Chain and its Tron cash-out.

Sources

Statements and researcher posts (X)

Coverage and investigations

On-chain (Tron)