We want to provide our community with a thorough update on the recent on-chain activity tied to TQKJQ. This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result.
Here’s The Full Story:
On 21st October, we noticed unusual activity in our systems. Our controls and immediate response measures prevented any impact to our active wallets and trading systems.
However, the next day we noticed irregular fund movement via the blockchain data and through reports from our user community. A deeper investigation revealed that the unusual activity had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities. The investigation also revealed that our automated sweeping service had failed for a particular period, causing deposits to accumulate in the deprecated address. This led to a loss of 15.99 million USDT which was absorbed by the company.
Crucially, our active trading and wallet infrastructure continued to operate without any pause, as demonstrated by uninterrupted trading activity, deposit and withdrawal experience.
We want to reiterate that all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls.
Why did we continue to process funds from deprecated wallet infrastructure?
Because the old operational wallets were exposed in last year’s incident, we deprecated the entire infrastructure that year. Despite clear guidance to use updated addresses, some users continued to mistakenly deposit funds to the deprecated address instead of the active addresses displayed in our app.
When deposits are mistakenly sent to a deprecated address, we face a choice: leave the user without any recourse or ensure their funds are protected. True to our customer-first philosophy, we choose to secure your assets. To do this safely, we run two distinct processes:
- Crediting funds to the user’s portfolio: The moment funds reach the deprecated wallet, we credit the user’s portfolio.
- Wallet sweeping: A secondary service then sweeps those funds from the deprecated address into the primary, secure CoinDCX wallet.
By decoupling these processes, we prioritize your funds. User accounts are credited right away, so your assets are immediately available and insulated from any technical issues in the backend sweeping process.
What this means for customers
- Your crypto deposit balances are unaffected and fully accounted for. Custody of your assets remains safe and secure, so you can continue to trade and invest with confidence.
- Always verify the latest deposit address in the CoinDCX app or website before every deposit. Depositing to deprecated addresses is highly risky, and exchanges do not typically take liability for them.
- For the last 72 hours, CoinDCX has run without a pause: no downtime, no limits on withdrawals, and no disruption to trading. All our systems continue to perform as usual.
It took us some time to do the thorough review of the deprecated infrastructure and confirm the sequence of events. We could have been more proactive, but we shared this update as soon as we had the complete picture.
Our Focus going forward
Protecting user assets remains, and will continue to remain, our first priority. Our active systems and the control systems built around them, shaped by past learnings, remain extremely resilient and robust. Going forward, we will strengthen our monitoring and controls around residual systems. We will also regularly remind users that the maintenance of deprecated addresses is a time-bound activity, and encourage them to proactively update their deposit addresses.
Our thanks go to the crypto X community for helping keep the ecosystem transparent and accountable. We deeply appreciate your continued vigilance and engagement, and your support and understanding mean a great deal to us.
If you have any questions, reach out to us at @CoinDCXCares or through the Support section in the app.
Team CoinDCX
