Tether has frozen approximately $2.21 million in USDT associated with the $15.99 million cryptocurrency outflow from wallets linked to Indian exchange CoinDCX, marking a significant intervention following the platform’s latest security incident.
Blockchain intelligence analysis published by BlockintAI shows that Tether blacklisted nine TRON addresses on October 22, 2026, preventing the movement of 2,212,850.29 USDT held across those wallets. The action followed suspicious transfers on October 21, when approximately 15.99 million USDT was moved from CoinDCX-associated addresses and distributed through multiple intermediary wallets.
The frozen amount represents approximately 13.8% of the reported loss, leaving most of the transferred funds outside the identified freeze. CoinDCX confirmed on October 25 that it had suffered a 15.99 million USDT loss after an automated wallet-sweeping service failed, allowing deposits to accumulate in infrastructure compromised during its July 2025 security breach.
The exchange said it absorbed the loss and that customer balances remained unaffected.
Nine Addresses Blacklisted as Investigators Trace Funds
According to BlockintAI’s investigation, the suspicious transfers initially converged on a TRON address before being distributed across several downstream wallets. On October 22 at 22:45:39 UTC, nine addresses were added to Tether’s USDT blacklist in the same blockchain block.
The combined balance of those addresses was 2,212,850.29 USDT, with individual holdings ranging from approximately 20,000 USDT to 664,939 USDT. BlockintAI traced the addresses back to the original receiving wallet using publicly available TRON transaction records.
The investigation also identified transfers reaching cryptocurrency exchanges including Binance, OKX and Gate. Earlier analysis by Bitquery estimated that approximately $9.63 million had reached addresses associated with those exchanges within 18 hours of the main outflow.
However, the identification of exchange deposit addresses does not establish whether the receiving accounts have been frozen or whether those funds remain recoverable. Tether’s intervention prevents the blacklisted addresses from transferring their USDT balances.
It does not automatically return the tokens to CoinDCX or establish the identity of the party responsible for the transfers. BlockintAI also reported that the blockchain records did not reveal who requested the freeze, and Tether had not issued a separate public explanation.
CoinDCX Acknowledges Operational Failure Behind Loss
The freeze follows a reversal in CoinDCX’s public account of the incident. After blockchain investigators initially identified the suspicious transfers, the exchange disputed reports of a new compromise, arguing that the affected addresses had been retired following its July 2025 breach.
However, investigators questioned that explanation after identifying subsequent activity involving the supposedly inactive wallets. In its October 25 disclosure, CoinDCX acknowledged that some customers continued sending deposits to those older addresses.
The exchange said it credited customers for those deposits while relying on an automated sweeping service to transfer the underlying assets into active wallets. When that service failed for an unspecified period, funds accumulated in the vulnerable infrastructure.
CoinDCX attributed the resulting 15.99 million USDT loss to that operational failure and said its active trading and wallet systems continued functioning normally. The incident follows a separate July 2025 security breach that cost the exchange approximately $44 million.
Together, the two incidents represent nearly $60 million in disclosed losses, although the circumstances differ. The latest freeze demonstrates how centralized stablecoin controls can limit the movement of suspected stolen assets even after funds have been transferred across blockchain addresses.
However, the majority of the October outflow had already moved beyond the nine blacklisted wallets. For CoinDCX, the remaining questions concern potential recovery of the unfrozen funds, the duration of the sweeping failure and the safeguards introduced to prevent deposits from accumulating in compromised infrastructure.
Until further disclosures emerge, the $2.21 million should be treated as frozen assets rather than confirmed recoveries.