ZachXBT Questions the Fate of $15.8 Million Deposits at CoinDCX
On-chain detective ZachXBT stated that the deposit address TQKJQ of the Indian crypto exchange CoinDCX was still used by a liquidity provider for about 10 months after a security incident in July 2025.
The address continued to collect user deposits and receive Gas funds, with the latest funds flowing to CoinDCX's currently public hot wallet in April and May 2026; ZachXBT pointed out that the fate of approximately $15.8 million in user deposits has not been explained by the team.
ZachXBT compared CoinDCX to the previously controversial Indian platforms WazirX and BitBNS, questioning the credibility of centralized exchanges in India.
CoinDCX previously responded that the related transactions involved an old wallet address created in January 2025, which was hacked in July of the same year, and that the platform has not used it since; current on-chain activities are unrelated to the platform, ensuring user fund safety.
There is a clear discrepancy between the two parties: the platform claims the old address has been abandoned, while ZachXBT points out that the address was still used to collect and flow into the current hot wallet after the incident; the specific situation of the $15.8 million funds remains to be further verified.
In July 2025, CoinDCX confirmed that its internal liquidity wallet was hacked, resulting in a loss of approximately $44 million, stating at the time that user funds were unaffected; this dispute focuses on the continued use of the old deposit address after the incident.
Source: Public Information
ABAB AI Insight
ZachXBT has long exposed anomalies in crypto platform funds through public on-chain tracking, previously marking the flow of stolen funds to mixers or exchange deposit addresses, and was among the first to publicly disclose related addresses and paths in the July 2025 CoinDCX internal wallet theft incident, prompting the platform to confirm a loss of approximately $44 million.
This time, he uses the behavior of the TQKJQ address continuing to receive deposits and aggregate to the current hot wallet after the incident as core evidence, with resource mobilization reflected in a direct comparison of the public hot wallet and historical deposit address on-chain records, demanding the platform explain the correlation of the $15.8 million, aiming to contrast the claim of "the old address has been abandoned" with the continued inflow of funds.
Similar paths have appeared in user fund disputes involving WazirX and BitBNS, with the market repeatedly questioning the transparency of reserve and address management of Indian platforms; the current stage is closer to treating the cleanup of addresses after a single security incident and ongoing monitoring as a trust verification point, rather than just focusing on the initial stolen amount.
This represents a shift in pricing power and trust structure: the safety of user deposits transitions from platform statements to a state that can be continuously verified by public on-chain records, with whether the address is still in use after the incident becoming a key variable for the market to reprice the risk premium of the platform.
ABAB News · Cognitive Law
- Continuous aggregation by the old address equals a conflict between platform statements and on-chain records.
- User fund safety depends on whether there are still inflows after the address is deactivated.
- The public hot wallet is the final reference point for verifying the historical deposit flow.