CoinDCX is contesting allegations by ZachXBT and Darcy concerning roughly $16 million in TRON-based outflows from addresses linked to the exchange. The transfers, reportedly flagged late on 2026-10-21, included 15.99 million USDT and 5,783.81 TRX. CoinDCX said the wallets had already been compromised in July 2025, rather than newly breached, leaving an ongoing dispute over whether old deposit routes remained active well after that hack.

What happened in the CoinDCX $16 million transfer dispute

The current dispute concerns TRON outflows reported late on 2026-10-21 from addresses linked to CoinDCX, rather than a confirmed new breach. According to the supplied report, Darcy identified transfers of 15.99 million USDT and 5,783.81 TRX to a single TRON address. CoinDCX reportedly denied any new security incident, instead linking the flagged wallets to its July 2025 compromise.

That leaves two competing interpretations of the same event. CoinDCX’s reported position is that attackers were reusing legacy addresses that had already been compromised. ZachXBT’s challenge is narrower, but carries greater implications for users: whether at least one of those addresses remained functionally connected to exchange operations long after the July 2025 incident. If so, the issue would be less about a fresh intrusion and more about unresolved exposure in wallet controls.

What CoinDCX’s sweep-failure explanation means

CoinDCX’s reported explanation goes beyond simply saying there was no new hack. Livemint reported that the company acknowledged a failed process intended to transfer deposits sent to retired compromised addresses into secure storage. CoinDCX said it absorbed the resulting operational losses.

This is an important distinction. It describes a situation in which active wallets were not newly compromised, yet losses could still occur because deposits or balances remained exposed at old addresses longer than intended. At the same time, the reported information does not establish how much CoinDCX lost, how long the process malfunctioned, or whether the losses it absorbed correspond to the roughly $16 million in disputed TRON outflows.

In the same reported account, CoinDCX said affected user deposits were credited and customer assets remained in segregated cold wallets. However, without direct wallet records or a full company statement, this does not resolve whether the disputed balances were customer deposits, corporate funds, or a combination of both.

Why the old-address question is the real risk signal

The key unresolved issue is whether the flagged wallets had genuinely been retired following the July 2025 hack. A crypto.news excerpt summarising ZachXBT said at least one TRON deposit address remained in use for around 10 months after the incident and continued sweeping deposits to CoinDCX’s current hot wallet through April and May 2026.

If that account is accurate, the risk signal is not simply that hackers interacted with old infrastructure again. It would suggest that the post-hack migration away from compromised deposit routes was incomplete, or that monitoring and automated fund transfers involving those addresses remained weak for an extended period. If CoinDCX’s interpretation is correct, however, the event appears more like delayed fallout from previously compromised legacy wallets than evidence of a second breach.

For readers seeking an answer to the central question, the clearest conclusion is limited: the available evidence points to an active dispute over the use of old wallets and a reported failure in the sweep process. It does not confirm that CoinDCX suffered a new hack, nor that the full roughly $16 million was verified client money lost from active wallets.