In a week that highlighted the fragility of crypto infrastructure, three separate security failures resulted in substantial financial losses and exposed user data, prompting industry‑wide calls for tighter controls. India's largest crypto exchange, CoinDCX, disclosed a $16 million shortfall tied to an internal process error involving retired wallets. At the same time, a high‑severity flaw in the popular Electrum Bitcoin wallet allowed attackers to replace legitimate transactions with counterfeit ones during the Replace‑By‑Fee (RBF) process, stealing at least one user's Bitcoin before a patch was issued. Adding to the string of incidents, hardware‑wallet manufacturer Keystone suffered a website breach that leaked the shipping addresses of recent buyers, raising concerns about physical and phishing attacks on crypto holders.
Indian Exchange Faces $16 Million Loss
CoinDCX, based in Mumbai, initially dismissed media reports of suspicious outflows as a "false alarm," according to statements from its CEO. Within days, the exchange confirmed that a malfunction in the handling of a retired wallet resulted in the loss of roughly $16 million – figures reported as $15.99 million by some outlets and $16 million by others. The company said it would absorb the loss without seeking compensation from users. The incident was first highlighted by CoinDesk and subsequently corroborated by The Block, CoinMarketCap, and several other local crypto news sites.
Electrum Wallet Flaw Enables Theft via Fee‑Bump
Separately, a critical vulnerability in the Electrum Bitcoin client – versions prior to 4.8.3 – was exploited by malicious servers that intercepted users’ attempts to accelerate pending transactions. By substituting the original transaction with a counterfeit one and prompting users to approve higher fees, attackers succeeded in diverting funds. CoinDesk, KuCoin, and multiple crypto‑focused outlets described the technique as hijacking the Replace‑By‑Fee (RBF) mechanism. The flaw was patched in Electrum version 4.8.3, which "closes the RBF theft bug," as reported by a Google News tech‑insider article.
"The developers released Electrum 4.8.3, which closes the RBF theft bug," the tech‑insider report said.
At least one victim confirmed a loss of Bitcoin before the update was applied, prompting a surge of urgent upgrade advisories across community forums. Traders Union, Crypto News, and other outlets emphasized that the vulnerability had been publicly disclosed only after the attacks, raising questions about the speed of response from open‑source maintainers.
Keystone Hardware Wallet Buyers’ Data Exposed
Keystone, a manufacturer of hardware wallets, experienced a website breach that exposed the mailing addresses of customers who had recently purchased its devices. Security researcher findings, reported by Cointelegraph, indicated that the leaked shipping details could be leveraged for targeted scams or even physical intimidation of crypto holders. While the breach did not directly compromise the wallets’ private keys, the exposure of personal data underscores the broader attack surface surrounding crypto assets, extending beyond on‑chain vulnerabilities.
These incidents arrive against a backdrop of heightened cyber‑risk metrics for the sector. According to data compiled by shattered.io, Q3 2026 recorded $1.18 billion in crypto‑related hacks, with 77 % of the attacks targeting entities lacking formal audits. A separate PHP vulnerability affected 793 of 1,488 surveyed crypto‑related domains, illustrating systemic software weaknesses that may be exploited in future campaigns.
Market participants have reacted cautiously. Bitcoin, the benchmark cryptocurrency, traded near $27,800 during the week, marginally below its three‑month high, as investors weighed the potential impact of security breaches on institutional confidence. Analysts note that while isolated incidents have historically caused short‑term price dips, the cumulative effect of repeated exploits could erode broader adoption unless remedial measures are accelerated.
Industry observers stress that the convergence of wallet software bugs, exchange processing errors, and data‑leak exposures signals a need for coordinated security standards across the crypto ecosystem. As developers rush to patch vulnerabilities and exchanges bolster internal controls, regulators in jurisdictions such as India are likely to scrutinize operational safeguards more closely, potentially shaping future compliance requirements for digital asset service providers.
Market Snapshot
| Asset | Price | 24h | Market Cap |
|---|---|---|---|
 Bitcoin BTC | $80,044 | -0.64% | $1609.0B |
 Ethereum ETH | $2,318 | -1.20% | $283.1B |
 BNB BNB | $738.73 | -0.72% | $97.1B |
 XRP XRP | $1.29 | -1.19% | $81.4B |
 Solana SOL | $100.88 | -0.73% | $59.5B |
 Dogecoin DOGE | $0.0769 | -0.20% | $12.0B |
 Cardano ADA | $0.203 | -1.43% | $7.6B |
Live data: CoinGecko — 2026-10-26 07:20 UTC
