Indian cryptocurrency exchange CoinDCX confirmed a $16 million hack after initially denying the breach. The attack targeted outdated wallet systems that had been discontinued following a previous hack in July 2025. The exchange attributed the theft to a temporary failure in an automated service responsible for moving customer deposits, which allowed funds to accumulate in an insecure wallet. CoinDCX absorbed the losses and assured customers that their funds remain safe, with normal trading operations continuing.
In Ireland, Coinbase was fined 3.25 million euros for failing to adequately protect customer funds. The central bank found that Coinbase Ireland mixed customer funds with money held by other Coinbase entities, leaving a shortfall of 5.2 million euros in 2024. The regulator also criticized Coinbase's reliance on its U.S. parent company's systems without sufficient local oversight. Coinbase accepted the penalty, which requires High Court approval.
New York Attorney General Letitia James is seeking $1.37 billion from NovaTech founders Cynthia and Eddy Petion over an alleged cryptocurrency investment scam. The lawsuit claims NovaTech collected over $1.16 billion in cryptocurrency deposits from investors between 2019 and 2023, with at least $134.5 million diverted to the founders' wallets. Authorities allege the company used a Ponzi-like scheme to pay earlier investors with funds from new investors.
Initia halted its blockchain operations after a $2.7 million security exploit. The attack exploited a flaw in MoveVM, a system that processes transactions, allowing the creation of unauthorized tokens and the transfer of digital assets. Co-founder Ezaan Mangalji stated that the flaw did not affect Initia's native INIT token. The company is investigating the incident with security experts and has not yet confirmed the final losses.
Hardware wallet maker Keystone disclosed a data breach exposing customer information, including names, contact details, and purchase records. The company detected unauthorized access to its Shopify-powered online store on October 20 and confirmed the data theft three days later. Keystone assured customers that payment information, wallet passwords, and private keys remained secure.
The U.S. Department of the Treasury sanctioned 10 individuals and one entity for allegedly aiding North Korea in generating revenue through fraudulent IT employment scams. The sanctions target networks using workers posing as legitimate remote employees to channel earnings toward North Korea's weapons programs. The action also identified cryptocurrency wallet addresses linked to the sanctioned individuals, expanding restrictions on their financial activities.