CoinDCX's chief executive called it a false alarm on Oct. 22, 20261. By Oct. 25, his own exchange confirmed the loss. Sumit Gupta runs India's largest crypto exchange. His first answer to a breach report became this week's clearest lesson. Read a CEO's denial against the numbers that follow it. Ten stories from Oct. 21 to Oct. 26, 2026, follow. They start with CoinDCX. The last one closes with robots now paying each other in crypto.
CoinDCX Admits the Loss It Denied
Sumit Gupta dismissed the first reports of a breach on Oct. 22, 20261. “The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm,” Gupta wrote on X. By Oct. 25, his exchange confirmed the loss. CoinDCX's blog named the cause. An automated sweeping service "had failed for a particular period." Deposits piled up in a wallet the exchange thought it had retired2.
CoinDCX's $15.99 million loss, confirmed Oct. 25, is a third of its $44 million 2025 hack
Confirmed dollar losses from CoinDCX's two wallet incidents, in millions of US dollars
- Oct. 2026 loss: $15.99M
- July 2025 hack: $44.00M
Sources: The Block [1]; CoinDesk [2].
Read the chart as a table
| Item | Value | Note |
|---|---|---|
| July 2025 hack | $44.00M | CoinDCX's first wallet breach, confirmed in July 2025 |
| Oct. 2026 loss | $15.99M |
On-chain investigator ZachXBT had already named the number. “CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team,” ZachXBT wrote on Oct. 223. CoinDCX absorbed the full $15.99 million loss itself. That sits on top of a $44 million breach the exchange suffered in July 2025.
A Hardware Wallet Maker Loses Customer Records
Keystone detected unauthorized access to its website on Oct. 20, 20264. The company confirmed the theft on Oct. 23. Stolen records held customer names, shipping addresses and order histories, pulled from Keystone's Shopify storefront. Payment details, recovery phrases and private keys stayed out of the breach, the company said. Some customers reported notices for purchases placed more than 180 days earlier. That is past the deletion window Keystone had promised.
Two Directors Leave a Solana Treasury Company
DeFi Development Corp. disclosed two resignations on Oct. 21, 20265. Board members Adam Townsend and Thomas Perfumo left with immediate effect. The filing said the departures came free of any disagreement over the company's operations, policies or practices. Chairman and chief executive Joseph Onorati signed the filing himself. Both seats sit open today. The board now runs two members lighter at a company that holds its treasury in Solana.
Six More Companies Reject a Tokenized Stock Venue
Wells Fargo, Cisco and Marvell joined the objectors this week6. Three other firms did too, against the OKX-ICE tokenized stock venue. The objections bring the total to 22 companies, up from nine on Oct. 15. OKX-ICE plans to let approved users trade tokenized U.S. stocks around the clock. Trades settle through Uniswap v4 pools on OKX's own blockchain. Every one of the six companies skipped a reason in its notice. An objection blocks trading on that single venue alone, and tokenization elsewhere stays open.
A British Bank Buys Its Own Custody Venture
Standard Chartered signed definitive agreements on Oct. 21, 2026, to acquire all of Zodia Custody7. It is the digital-asset custodian the bank launched with Northern Trust in 2020. Standard Chartered will fold Zodia's custody business into its own securities-services arm. Zodia's software and advisory unit splits off into a new company, Zodia Solutions. Northern Trust, NAB Ventures, SBI Ventures and Emirates NBD Bank back it. Both sides kept the price private. The deal still needs regulators' sign-off.
Lummis Says Democrats Wrote the Caps They Rejected
Sen. Cynthia Lummis said Democrats requested the limits that then sank a committee vote on the CLARITY Act8. “Democrats asked to cut the annual Regulation Crypto fundraising cap from $75 million to $50 million and add a $200 million lifetime limit. We agreed to both and included them in the Clarity Act. Democrats voted against the rules they wrote to protect retail investors,” Lummis said on Oct. 25. The bill's crowdfunding exemption would let a crypto startup raise outside full SEC registration. Lummis described the lower caps that exemption now carries.
Seoul Weighs a Fourth Delay on Crypto Taxes
South Korea's presidential office is leaning toward delay9. Its crypto gains tax would push back to Jan. 1, 2029. The levy was first due in 2022, and this would be its fourth delay. A bill from 14 lawmakers ties the tax's start to international data-sharing deals. Those deals begin exchanging U.S. trading records that same year. Officials worry domestic exchange users alone would carry the tax now. South Korea's regulators can see domestic trading alone. Activity on U.S. platforms stays outside their view. Parliament must act on the amendment by early December.
Bitcoin's Supply Still Hides Its Owners
Galaxy Research counted 11.1 million bitcoin in unclaimed wallets10. Zero known exchange, fund or government claims them. That is 55 percent of the 20.1 million bitcoin mined so far. Alex Thorn, Galaxy's head of research, named the pattern. "Despite all the institutionalization and centralized ownership over the years," the count still holds, Thorn said. Wall Street's bitcoin ETFs hold a record share of the supply on paper. Even so, more than half the coin answers to zero public name.
October Becomes DeFi's Costliest Month
Eleven separate DeFi exploits drained $718 million in October 202611. Blockworks reported the figure from Chainalysis data. It is the worst single month the tracker has recorded. Bridge exploits made up 82 percent of that total, about $589 million. Every other October exploit combined cost $129 million. Four of the eleven hits landed on a single day, Oct. 11. Chainalysis called that clustering a sign of coordinated or copycat attacks. Attackers increasingly convert what they steal into DAI, a stablecoin whose protocol holds zero freeze switch.
Bridge exploits caused $589 million of DeFi's $718 million in October 2026 losses
DeFi exploit losses by cause, in millions of US dollars, for October 2026
- Bridge exploits: $589M
- Every other exploit: $129M
Source: Startup Fortune [11].
Read the chart as a table
| Item | Value |
|---|---|
| Bridge exploits | $589M |
| Every other exploit | $129M |
Robots Start Paying Each Other in Crypto
X Pay raised $1 million to build payment rails for AI agents12. Nine investors backed the round, including DCI, Skyland Ventures, Zerra Ventures and Dubai Blockchain Lab. The company has settled more than 50,000 payments since launch. It went live on Base's mainnet in September 2026. The rails run on x402, a payment standard Coinbase gave to the Linux Foundation. Chief executive Johnny Sluijmer named the problem his company solves. “X Pay did not create x402, which Coinbase contributed to the Linux Foundation, but built the layer that turns it into an operable business, enabling millions of APIs to charge for services previously too small to monetize,” Sluijmer said.
What to watch
Watch CoinDCX's next transparency report. It will show whether the deposit-sweeping fix holds. Watch too whether Indian regulators ask for more than the exchange has already published. DeFi Development Corp. may still name successors for Townsend and Perfumo. The OKX-ICE objector list could keep growing past 22 names. South Korea's parliament has until early December to act on the tax delay. The Senate could revive the CLARITY Act now that Lummis says its investor caps came from the other side of the aisle.
Sources
- Zack Abrams, "CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a 'false alarm'," The Block, Oct. 25, 2026, https://www.theblock.co/news/business/2026-10-25-coindcx-confirms-16-million-loss-from-retired-wallets-days-after-ceo-called-breach-reports-a-false-alarm-431617
- Omkar Godbole, "CoinDCX absorbs $16 million loss from internal process failure tied to retired wallet," CoinDesk, Oct. 26, 2026, https://www.coindesk.com/markets/2026/10/26/coindcx-absorbs-usd16-million-loss-from-internal-process-failure-tied-to-retired-wallet
- Rony Roy, "CoinDCX denies second hack claims as ZachXBT questions wallet activity," crypto.news, Oct. 22, 2026, https://crypto.news/coindcx-denies-second-hack-claims-as-zachxbt-questions-wallet-activity/
- Karthik Subramanian, "Keystone Wallet Breach Leaks Addresses Despite 180-Day Rule," FinanceFeeds, Oct. 26, 2026, https://financefeeds.com/keystone-hardware-wallet-suffers-data-breach-exposing-customer-addresses-and-purchase-records/
- Manish Choudhary, "DeFi Development Corp. Announces Immediate Resignations of Directors Townsend and Perfumo," Kalkine Media, Oct. 21, 2026, https://kalkinemedia.com/us/news/announcements/defi-development-corp-announces-immediate-resignations-of-directors-townsend-and-perfumo
- "Wells Fargo, Cisco, Intuit Among 6 More Companies Objecting to Tokenized Stocks," Decrypt, Oct. 25, 2026, https://decrypt.co/381784/wells-fargo-cisco-intuit-more-companies-object-tokenized-stocks
- James Hunt, "Standard Chartered signs definitive agreements to acquire Zodia Custody," The Block, Oct. 21, 2026, https://www.theblock.co/news/business/2026-10-21-standard-chartered-signs-definitive-agreements-to-acquire-zodia-custody-421535
- Riza Dagoc, "Lummis Says Democrats Opposed Advancing CLARITY Act After Cap Changes," TokenPost, Oct. 25, 2026, https://www.tokenpost.com/news/regulation/40560
- Francisco Rodrigues, "South Korea considers fourth delay on its crypto gains tax, pushing it to 2029," CoinDesk, Oct. 26, 2026, https://www.coindesk.com/policy/2026/10/26/south-korea-weighs-fourth-delay-on-its-crypto-gains-tax-pushing-it-to-2029
- Omkar Godbole, "Over 11 million BTC can't be linked to any known owner even after Wall Street buying," CoinDesk, Oct. 26, 2026, https://www.coindesk.com/markets/2026/10/26/over-11-million-btc-can-t-be-linked-to-any-known-owner-even-after-wall-street-buying
- Walter Schulze, "October 2026 Becomes DeFi's Costliest Month as Hackers Launder Through DAI," Startup Fortune, Oct. 24, 2026, https://startupfortune.com/october-2026-becomes-defis-costliest-month-as-hackers-launder-through-dai/
- James Dargan, "X Pay Secures $1M to Scale Payment Infrastructure for AI Agents," The AI Insider, Oct. 25, 2026, https://theaiinsider.tech/2026/10/25/x-pay-secures-1m-to-scale-payment-infrastructure-for-ai-agents/