A public challenge from one of the cryptocurrency industry's most prominent on-chain investigators has put CoinDCX, one of India's largest cryptocurrency exchanges, under renewed scrutiny. On October 22, 2026, ZachXBT — the pseudonymous blockchain forensics researcher whose on-chain analyses have previously exposed fraud and mismanagement across the digital asset industry — published a post on X asserting that a deposit address connected to a security incident at CoinDCX in 2025 had not only remained active in the months following that breach, but had continued to receive user funds during that period. At the center of the allegation: $15.8 million in deposits that ZachXBT claims cannot be satisfactorily accounted for.
The Core Allegation: A Compromised Address Left Open
The gravity of ZachXBT's claim rests on two distinct but related failures, if proven accurate. The first is operational: that CoinDCX allowed a wallet address previously identified as compromised in a 2025 security incident to remain live and functional for an extended period afterward. In standard security practice across both traditional finance and digital asset infrastructure, any address, account, or credential touched by a known breach is decommissioned immediately. Leaving a compromised address active is not a gray area — it represents a fundamental failure in incident response protocol. The second alleged failure is financial transparency: ZachXBT's assertion that $15.8 million in deposits routed through that address remain unaccounted for raises direct questions about whether those user funds are fully reconciled on CoinDCX's books, and whether affected users have been properly informed or made whole.
Why On-Chain Evidence Carries Weight
ZachXBT's methodology — tracing wallet activity directly on public blockchain ledgers — is difficult to dismiss as mere speculation. Unlike accusations based on whistleblower testimony or internal document leaks, on-chain forensic analysis relies on immutable, publicly verifiable transaction data. Every deposit into, and withdrawal from, a blockchain address is permanently recorded. When ZachXBT identifies $15.8 million in deposits linked to a specific address and characterizes them as unaccounted for, the implication is that the corresponding outflows, internal transfers, or user credit acknowledgements for those funds cannot be cleanly traced or reconciled through observable blockchain activity. That is a forensically specific claim — and one that demands a forensically specific rebuttal from CoinDCX.
CoinDCX's Position in India's Crypto Market Raises the Stakes
CoinDCX is not a peripheral player in the Indian digital asset landscape. The exchange has positioned itself as one of the country's most prominent retail-facing crypto platforms, operating in a regulatory environment that has grown increasingly formalized following India's framework for virtual digital assets. The platform serves a large base of retail investors — many of whom may lack the technical sophistication to independently audit whether their deposit addresses have been compromised or whether their funds are properly custodied. That asymmetry of information between the exchange and its users is precisely what makes ZachXBT's public disclosure significant: it surfaces risk that retail depositors could not have identified on their own.
Incident Response and the Industry Standard
The 2025 security incident referenced in ZachXBT's post has now taken on additional significance beyond whatever immediate impact it had at the time. A breach that results in a compromised deposit address is serious in its own right; a compromised address that continues routing live user funds for months afterward compounds the liability exposure substantially. If the $15.8 million figure represents deposits that flowed through the address after the point at which CoinDCX was or should have been aware of the compromise, then the exchange faces questions not only about its technical response capabilities but about its disclosure obligations to users and, potentially, to Indian financial regulators overseeing virtual asset service providers.
The Accountability Gap in Emerging Crypto Markets
ZachXBT's intervention highlights a structural accountability gap that persists across many cryptocurrency exchanges operating in high-growth emerging markets. Regulatory frameworks, while improving, often lag behind the operational realities of fast-scaling platforms. Proof-of-reserves disclosures, independent security audits, and mandatory breach notification timelines — all standard expectations in more mature financial services environments — remain inconsistently applied across the sector. When institutional oversight mechanisms are incomplete, the informal accountability supplied by on-chain investigators like ZachXBT fills a genuine public interest function, however uncomfortable that function may be for the exchanges it scrutinizes.
What This Means
The $15.8 million figure cited by ZachXBT is not a rounding error — it is a material sum by any measure, and it demands a transparent, detailed response from CoinDCX that goes beyond a standard reassurance statement. The exchange must address two specific questions directly: first, whether the compromised deposit address was knowingly left active after the 2025 security incident, and for how long; and second, what the current status is of every deposit routed through that address. Retail users of the platform deserve a full accounting, and Indian regulators overseeing the virtual asset space should be closely monitoring whether the exchange's response meets the disclosure standards now expected of licensed virtual asset service providers. In the broader context, this episode reinforces a principle that the industry continues to learn at cost: security incidents are not closed when the immediate threat is neutralized — they are closed only when every affected address, credential, and user account has been fully remediated and accounted for.
Written by the editorial team — independent journalism powered by Codego Press.