An exchange called its addresses retired. A wallet maker said the seeds were safe. A chain said its token supply was unaffected. Every one of those statements was accurate. That was the problem.

Last Sunday I wrote about a week in which the industry announced readiness for a threat that still lives mostly on a whiteboard.¹ This week the threats were already in the building, and the industry answered with something it is much better at than quantum migration: wording.

I do not mean lying. I mean the careful sentence, the one a lawyer and a comms lead agree on at 3am. It is true, it is narrow, and it is built to be quoted.

Three of them arrived between Thursday and Saturday. A fourth statement, from a wallet’s open-source developers, did something rarer. It just said what happened.

“Retired”

On Wednesday, about 15.99 million USDT left TRON addresses labelled as belonging to CoinDCX, the Indian exchange, by our reading of public records.² On Thursday morning CoinDCX said this was not a new breach. The addresses had been compromised in its July 2025 hack and “have not been used by CoinDCX since,” it wrote. “Users’ funds are safe.”³

“Retired” is a lovely word. It suggests a gold watch and a quiet house by the sea. The ledger suggested a busier pension.

By our read, the main address forwarded USDT every month from March 2025 to January 2026, and again in April and May this year. On-chain investigator ZachXBT replied that a liquidity provider had used it for 10 months after the hack.⁴

Three and a half hours later, the statement grew a second paragraph. Some users had kept depositing to the old addresses, CoinDCX said, and its process for sweeping those deposits “failed.” That led to “some operational losses, which were absorbed by CoinDCX,” and affected users were credited.⁵

Notice what each sentence does. “Not a new breach” is about the cause. “Users’ funds are safe” is about the customers. “Operational losses” is about the books.

None of them, on its own, tells you who controlled 15.99 million dollars of stablecoins on a Wednesday afternoon. Tether later blacklisted nine addresses holding about 2.2 million USDT.⁶ Tether has not commented.

“Safe”

Keystone, the hardware wallet maker, had the hardest job of the week and the best first line. Recovery phrases, private keys and wallet passwords were not exposed, it said on Saturday, after confirming that a third party had taken customer names, contact details, shipping addresses and order details from its website.⁷

That is true, and it matters. The device did its job. But a hardware wallet company’s customer list is a list of people who probably own crypto, with their front doors attached. Our colleague Dalia Haddadin put it in two lines: your seed is safe; your doorstep is not.⁸

The calendar is the quieter part. Keystone says it detected unauthorised access on 20 Oct, confirmed the data loss with Shopify on 23 Oct, posted an “urgent investigation” notice at 05:09 UTC on 24 Oct, and disclosed the breach at 17:59 UTC that evening. On the night of 23 Oct, one user said a caller with a spoofed police number had already asked whether the name Keystone meant anything to them.⁹ If that call was connected, the scammers read the customer list before the customers read the apology.

Keystone has not said how many people are affected. It has promised a detailed report “in the coming days.” I will read it with interest, because “safe” is a word about the device, and the risk now sits with the owner.

“Unaffected”

Initia, a layer-1 chain, halted on Friday after what it first called “a security incident.”¹⁰ On Saturday morning it named the cause: a bug in its MoveVM script caching that let malicious code bypass security checks and credit an attacker with unbacked WETH, iUSD and USDC. About $2.7 million left for Ethereum. Initia added that no native INIT was minted, and that INIT’s total supply was unaffected.¹¹

Both statements are true. They also answer a question few people were asking. The tokens that mattered here were not INIT.

They were bridged dollars and ether, credited on Initia without backing and redeemed on Ethereum for the real thing. By Initia’s own account, the bug credited them without changing those tokens’ total supply. A supply figure that does not move is a fine thing to report. It is not the same as nobody losing money. D2 Finance, which traced the flows, put it plainly: the loss “sits with the adapter’s depositors,” the people who had locked AUSD in the bridge contract.¹²

As of 04:47 UTC this morning, the attacker’s Ethereum wallet still held 1,135.52 ETH and had never sent a transaction, by our read. Upbit and Bithumb suspended INIT deposits and withdrawals on Saturday.¹³ The chain is still stopped.

The plain one

And then Electrum. One of the oldest bitcoin wallets shipped version 4.8.3 on Saturday with an advisory that reads like a police report written by an engineer.

It rated the flaw high severity, said malicious servers had been exploiting it, and said one user had lost money. It explained the trick: a server swallowed a real payment, showed a forged one paying the attacker, and waited for the user to bump the fee. It gave the dates, from a first private report on 11 Oct to disclosure on 24 Oct.¹⁴

There was no “out of an abundance of caution.” There was no “a small number of users.” It did not give the amount lost, and it said so.

Our Alasdair Rennick called the attack the swapped envelope.¹⁵ I would call the advisory the unswapped one: the letter said what was in it.

I do not expect every exchange to write like a GitHub advisory. Companies have shareholders, regulators and customers on the phone.

But the week offers a simple test for the next statement you read. Ask what the sentence is about. Is it about the cause, the customer, the books, the device, or the supply? Then ask which of those five it left out.

Incident ledger

  • CoinDCX-tagged addresses · about 15.99M USDT out on 21 Oct (our TRON read); about 2.2M USDT frozen by Tether. CoinDCX says the losses were operational, absorbed by the exchange, and users were credited. Our CoinDCX report.
  • Initia · about $2.7M bridged to Ethereum (Initia’s figure). Chain halted since 23 Oct; INIT transfers suspended at Upbit and Bithumb. Initia’s halt.
  • Keystone · customer names, contacts, addresses and orders taken from its website; no funds reported lost; number affected not disclosed. Keystone’s breach.
  • Electrum · at least one user lost money to malicious servers; amount not disclosed; fixed in 4.8.3. Electrum 4.8.3.
  • Zheng Zhao · extradited to Los Angeles, accused of helping launder more than $36.9M from 174 identified US victims of Cambodian scam centres, the US Justice Department says. He is charged, not convicted, and presumed innocent.¹⁶ Our report.

Running total: not summed. Adding $16M and $2.7M would give a number nobody has confirmed as a user loss. CoinDCX says it absorbed its share; Initia’s sits with bridge depositors; Electrum’s is undisclosed. The Zheng Zhao figure is an allegation in a US case.

Elsewhere

  • Kraken withdrew questionnaires it had sent to Monero buyers, and its co-CEO said no rule had required them. Another careful sentence, this one in the customers’ favour: Kraken’s Monero U-turn.
  • In Buenos Aires, a judge closed the LIBRA case against President Javier Milei, his sister and nine others, ruling that the reported events did not fall under a legal category. A legal finding, not a review of the token: the LIBRA dismissal.
  • Bitcoin briefly traded below $80,000 on Saturday as about $404 million of long bets were liquidated: Saturday’s Market Read.

Close

Retired, safe, unaffected. Three words, each defensible, each chosen by people who knew it would be quoted.

I do not hold that against them. I only note that the most reassuring statement of the week came from the project that admitted a user had lost money.

Next week, read the second paragraph first.

See you next Sunday. — L.C.

Footnotes

  1. The Quantum Week, 18 Oct.
  2. Public TRON records read by CryptoWatchDesk on 22 Oct; see our CoinDCX report.
  3. CoinDCX on X, 22 Oct, 08:14 UTC.
  4. ZachXBT on X, 22 Oct, 08:52 UTC; monthly transfer pattern by our read of TRON records.
  5. CoinDCX on X, 22 Oct, 11:47 UTC.
  6. Tether blacklist entry at 22:45:39 UTC on 22 Oct per TronGrid; about $2.2M per AMLBot as reported by The Defiant. Tether and CoinDCX did not comment.
  7. Keystone on X, 24 Oct, 17:59 UTC. Its post says payment card and bank details, recovery phrases, private keys and wallet passwords were not exposed.
  8. Dalia Haddadin, Keystone report, 24 Oct.
  9. Timeline as stated by Keystone; the spoofed-call account is one user’s post on X, not verified by us.
  10. Initia on X, 23 Oct, 16:00 UTC.
  11. Initia on X, 24 Oct, 08:46 UTC.
  12. D2 Finance on X, 23 Oct, 17:47 UTC. Agora, which issues AUSD, said AUSD was unaffected and fully backed.
  13. Ethereum balance and transaction count via a public RPC node, 25 Oct, 04:47 UTC; exchange suspensions per TokenPost, 24 Oct.
  14. Electrum advisory GHSA-6jp4-8v48-cc5v, published 24 Oct, 12:52 UTC.
  15. Alasdair Rennick, Electrum report, 24 Oct.
  16. US Department of Justice, 23 Oct.

References

  • CoinDCX on X, 22 Oct 2026. https://x.com/CoinDCX/status/2113182200648864243 and https://x.com/CoinDCX/status/2113235810988531883
  • The Defiant, Tether blacklists USDT wallets linked to CoinDCX outflows, 23 Oct 2026. https://thedefiant.io/news/hacks/tether-blacklists-usdt-wallets-linked-to-coindcx-outflows
  • Keystone on X, 24 Oct 2026. https://x.com/KeystoneWallet/status/2114054080754770137
  • Initia on X, 23 and 24 Oct 2026. https://x.com/initia/status/2113661738625155217 and https://x.com/initia/status/2113915002008612945
  • D2 Finance on X, 23 Oct 2026. https://x.com/D2_Finance/status/2113688711208779795
  • Electrum security advisory, 24 Oct 2026. https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
  • US Department of Justice, 23 Oct 2026. https://www.justice.gov/opa/pr/chinese-national-extradited-alleged-role-multimillion-dollar-cryptocurrency-scam-targeting
  • TokenPost, 24 Oct 2026. https://www.tokenpost.kr/news/breaking/426838

This article is for information only and is not investment advice.