Tether Blacklists USDT Wallets Linked to CoinDCX Outflows

Tether has blacklisted TRON wallets that blockchain-tracing firm AMLBot links to roughly $16 million in outflows from CoinDCX-linked addresses, with AMLBot putting the frozen sum at about $2.2 million.

$USDT contract event logs confirm the blacklisting of three addresses specifically named by AMLBot. Tronscan’s blacklist records list approximately 1.385 million $USDT frozen across those three wallets at 6:45 p.m. ET on Oct. 22. AMLBot said roughly $800,000 more was frozen across five other addresses.

The action targets funds downstream of the disputed outflows, but does not establish who controlled the original deposit wallets. CoinDCX has since acknowledged that users continued depositing to addresses compromised in July 2025 and that a failure to move those deposits into secure wallets caused losses the exchange says it absorbed.

In its Oct. 23 update, AMLBot said two wallets it had previously been monitoring moved their funds one more address along before the freeze. One split funds between two recipients; the other sent funds to a third. “All three are now frozen,” the firm wrote.

The three blacklisted recipients named in that update were:

- `TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a`, with approximately 664,939 $USDT frozen. - `TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG`, with approximately 400,995 $USDT frozen. - `TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs`, with 319,000 $USDT frozen.

AMLBot’s earlier tracing report said roughly 40 CoinDCX-linked deposit addresses were drained on Oct. 21, with funds converging on `TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT`. It attributed subsequent deposits of about $5.5 million to OKX, $2.8 million to Binance and $1.4 million to Gate, while saying a large share passed through unidentified services.

CoinDCX Acknowledges Deposit-Sweeping Losses

As The Defiant previously reported, CoinDCX co-founder Sumit Gupta initially denied a new breach, saying the flagged wallets were old addresses compromised in July 2025.

ZachXBT challenged that account, saying the deposit address abbreviated TQKJQ had remained in use by a liquidity provider for 10 months after that incident. He said it had sent user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026, and alleged that $15.8 million in user deposits had gone unaccounted for.

CoinDCX’s subsequent statement acknowledged continuing deposits to deprecated addresses despite its warnings. It said its regular “sweeping” process—moving deposits out of those wallets so they could be accounted for and secured—had failed for a period.

“This failure led to some operational losses, which were absorbed by CoinDCX,” the exchange said. It said affected users had been credited, while maintaining that current central and user addresses were unaffected and no funds from active wallets had been compromised.