Onchain Security Roundup: Oct 19 - Oct 26

CoinDCX Retired Deposit Wallets Drained on TRON

TL;DR: On October 21st, 15.9M USDT (plus a reported 5,784 TRX) left 40 TRON addresses that the Indian exchange CoinDCX had retired after its July 2025 breach. CoinDCX first called the reports a possible false alarm, then on October 25th confirmed a $16 million loss, blamed a failed automated sweeping service, and absorbed the loss. It has not said how the funds were taken. Tether reportedly froze $2.2M.

CoinDCX is one of India's largest centralized exchanges and previously lost $44 million in a hot-wallet breach in 2025. After that incident it deprecated the deposit addresses involved. By its own account on October 25th, users kept depositing to those addresses, the deposits were credited to their accounts, and an automated service that should have swept the balances into fresh custody "had failed for a particular period." The deprecated addresses therefore accumulated a large balance that nobody was watching.

Between 12:33 UTC on October 21st and 00:52 UTC on October 22nd, 46 USDT transfers from the old deposit addresses reached one newly created wallet, totaling 15,991,414 USDT. The largest single transfer, 15,819,002 USDT, landed at 15:35 UTC on October 21st. The onchain investigator Darcy published the receiving address and the 5,784 TRX leg the same night, and TokenPost reported that the funds were then split and routed toward Binance, OKX, and Gate deposit addresses. Crypto Briefing reported that Tether froze $2.21 million of the USDT across eight addresses on October 22nd.

On October 23rd, CEO Sumit Gupta described the reports as a possible false alarm and said user funds were safe. Later on October 25th, the company confirmed the loss, noted it had detected unusual activity on October 21st, and said the sweep failure, not a new breach of its custody, explained why the balances were exposed. It did not name a responsible party, describe the mechanism of the theft, or call the event a hack. ZachXBT and Bitquery dispute the "retired" framing, saying at least one of the addresses kept interacting with the exchange's hot wallet for months after the 2025 breach.

CoinDCX has not publicly confirmed how the signing authority was obtained. No funds have been recovered to date beyond the reported Tether freeze.

X100 Global Flash Loan Governance Takeover

TL;DR: On October 24th, an attacker used a 1.9M USDT Aave flash loan to buy two of the three seats on X100 Global's "Senate," pass a proposal in the same transaction, and sell 400,000 treasury X tokens at 35.68 USDT. Blockaid valued the loss across two transactions at $4.85 million, with another pulling 550,000 X of liquidity. Two onchain bounty offers followed. No funds have been recovered to date.

X100 Global is an Ethereum project whose treasury, held in a "Freezer" contract, is governed by a three-seat Senate. Per the decoded transaction and analyses by Blockaid, Phalcon, and ExVul, anyone could take a seat by freezing X and paying a 100 X candidacy fee, with votes counted at the moment of the proposal rather than from a snapshot, executing proposals in the same block. There was no delay between joining, voting, and spending the treasury.

The first transaction, sent from an address with no prior history, did everything at once. It borrowed 1,942,457 USDT from Aave, bought 38,200 X from the Uniswap V3 pool, and split the tokens between two helper contracts. Each helper froze 19,000 X plus the 100 X fee and took a Senate seat. The helpers then created proposal #7, whose description reads "testnet flash governance proof," and voted it through. The proposal approved 400,000 X from the Freezer to a PancakeSwap V3 router and sold the tokens into a pool the attacker had created, so the treasury received 35.68 USDT for them. After the attacker sold its own X back into the real pool and repaid the loan, its address held 4,749,726 USDT. A second address repeated the pattern at 14:35 UTC, and Blockaid reported a third removing 550,000 X of Uniswap V3 liquidity.

Blockaid valued the loss across the first two transactions at $4.85 million. ScamSniffer traced the first attacker's USDT into 2,022.86 ETH held across five fresh addresses, and the X token fell 96%. On October 25th, two onchain messages from two different senders offered the attackers a deal: one asked for 1,600 ETH back, the other for half of 4,848,017 USDT, with different return addresses in each. Neither sender has been confirmed as X100, and X100 has not publicly issued a postmortem.

Initia MoveVM Script Cache Bug and Unbacked Bridge Withdrawals

TL;DR: On October 23rd, an attacker exploited a script-caching bug in Initia's MoveVM to credit itself with WETH, iUSD, and USDC balances that no deposit backed, then bridged $2.7 million out over LayerZero, Noble, and CCTP before Initia halted its L1 and rollups. Initia says a fix and audit will take days and has set no restart date. No funds have been recovered to date.

Initia is a Layer 1, built on the Cosmos SDK, that runs the Move virtual machine and hosts a family of rollups. Initia said the attacker used a "Day-0" vulnerability in the MoveVM's script caching that bypassed security checks and forged VM state. The forged state credited the attacker with WETH, iUSD, and USDC balances while token supplies stayed unchanged, so nothing was minted in the ordinary sense. Native INIT was not affected.

The exploit started at 14:59 UTC on October 23rd. Bitquery reported that the credits arrived in four batches over 13 seconds with a face value of $7.48 million, most of it iUSD that could not be redeemed. By Initia's account, 105 WETH and 1.4 million AUSD0 left over LayerZero and 1.08 million USDC left over Noble and CCTP, and everything was swapped into 1,135.52 ETH at one Ethereum address. That wallet holds 1,135.52 ETH and was funded at 15:41 UTC, five seconds after the stated halt time. Noble's USDC reserve for Initia fell to $63 with 55 failed withdrawal attempts behind it.

Initia halted the L1 and its rollups at 15:41 UTC and said recovery efforts with security partners were under way. Agora said it has no native AUSD contracts on Initia, that its reserves were unaffected, and that it would freeze attacker-linked AUSD. Upbit and KuCoin suspended INIT deposits and withdrawals. As of October 25th the chain remained halted, and Initia has not publicly confirmed a restart date.

BloomTrading Bot Wallet Drains on Solana

TL;DR: On October 26th, 9,408 SOL ($947,000) was drained from 49 Solana wallets. Bloom, the Telegram trading bot that generated and held the keys, says a remote code execution flaw in a third-party module was exploited, no private keys were compromised, nine users across 49 wallets were affected, and that it will reimburse them fully. No funds have been recovered to date.

Bloom is a Telegram-based trading bot for Solana that creates wallets for users and holds the keys needed to trade from them. The first drain landed at 1:00 UTC on October 26th and the last at 1:04 UTC. Only SOL was taken; aside from address-poisoning dust, no USDC reached the drainer.

The drainer address received 9,408.21 SOL from 49 distinct wallets between 01:00 and 01:04 UTC on October 26th. Each transfer was signed by the victim wallet's own key, which is consistent with an attacker who could exploit Bloom's signing infrastructure.

Bloom's first public response was a reply to an affected user at 20:02 PT saying it was investigating. At 09:12 UTC on October 26th, Bloom posted that the attacker had exploited a remote code execution vulnerability in a third-party module. The team stated no private keys were accessed or compromised, that 49 wallets belonging to nine users lost 9,408 SOL, and pledged to reimburse all affected users in full. It also said it had paused some services and was working with partners to trace and freeze the funds. Bloom has not publicly confirmed which module failed.

NEM Token Skim-and-Burn Reserve Manipulation

TL;DR: On October 21st an attacker drained 821,920 USDT from the PancakeSwap USDT/NEM pool on BNB Chain in a single transaction. The NemTokenV2 contract credited tokens sent to the pool as pending sells before any swap settled, and a permissionless function then burned NEM out of the pool against that stale credit and resynced the reserve. It ran 42 times with flash-loaned USDT, pushing the price up before the attacker swapped out. No funds have been recovered to date.

NEM is a BNB Chain token (NemTokenV2) with a PancakeSwap V2 pool against USDT (not the older NEM blockchain). The contract tracked a counter named pendingLpSellRecycle that was credited whenever tokens were transferred into the pair, on the assumption that a transfer into the pool meant a sale. The counter was never reconciled against an actual swap, and a second function, flushLpSellRecycle, could be called by anyone to burn that many NEM from the pair's own balance and call sync().

The attacker, using an address funded through Tornado Cash, flash-loaned USDT from Moolah, Venus, and PancakeSwap and pushed 235,785,000 USDT into the pair to make its reserve enormous relative to NEM. It then ran a transfer, skim(), and flush loop 42 times: transfer NEM into the pair to raise the pending-sell counter, call skim() to take the tokens back out while the counter survived, and flush to burn NEM from the pair and sync the lowered reserve. With the NEM reserve burned down to a handful of tokens, a tiny NEM input swapped out 236,606,920 USDT. The pool paid out 821,920.44 USDT more than the attacker had put in, which is the figure SlowMist reported. Defimon put the net after flash-loan costs at $726,000, and CertiK counted $820,000.

The transaction was confirmed at 03:28 UTC on October 21st, a day before the public alerts on October 22nd. The NEM team has not publicly confirmed the incident.

WAX Bridge Negative Fee Withdrawals

TL;DR: On October 22nd, a freshly created WAX account submitted five bridge withdrawals with a negative max_fee equal to the withdrawal amount, so the WAX side debited nothing while the bridge still recorded full withdrawals. Solana then paid 52,986.50 USDC and Ethereum released 21,558 USDT, 840 DAI, 2.55 WETH, and 0.11 WBTC ($90,500). No funds have been recovered to date.

The WAX Multi-Chain Bridge moves tokens between the WAX blockchain, Solana, and Ethereum. Per Blockaid's analysis, the eth.token::withdraw action on the WAX side debited quantity plus max_fee from the user and never required max_fee to be non-negative. A withdrawal of X with a fee of minus X therefore cost the user zero on WAX, while the bridge logged a withdrawal of X that the destination chains honored.

The account fasdfas.al was created at 09:06 UTC on October 22nd. Just 40 minutes later, between 09:46 and 09:48 UTC it submitted five withdrawals. At 10:00 UTC the Solana side paid 52,986.50 USDC to an attacker address. On Ethereum, the bridge contract released 21,558.25 USDT at 10:05 UTC, then 840.28 DAI, 2.5467 WETH, and 0.1099 WBTC in the following three blocks, all to one address, which quickly swapped it through aggregators.

WAX has not publicly confirmed a fix.

Swell Network Hot Key Compromise (No Confirmed Loss)

TL;DR: On October 21st, an unknown actor controlled Swell Network's operational hot keys, including the oracle bot for swETH and rswETH, and raised both exchange rates by the 1%-per-hour maximum with no ETH behind the increase. Per Spreek's incident report, four upgrade payloads capable of sweeping 2,513 ETH ($6.2 million) were deployed but never installed, and no ETH left the core contracts. Swell paused deposits and withdrawals on October 23rd and queued key revocations on its timelock. The investigation is ongoing.

Swell is a liquid staking and restaking protocol whose swETH and rswETH tokens accrue value through an exchange rate that an offchain bot writes to the contracts. The incident was documented in detail by the security researcher Spreek in a report published on October 22nd. Spreek counted 30 operational keys under the actor's control across Ethereum, Arbitrum, Base, and HyperEVM, and traced the actor's first activity, a top-up of the bot funds deployer, to 14:25 UTC on October 21st.

Starting at 23:02 UTC, the actor began repricing. The reprice transaction was confirmed as a successful call on Ethereum. By 01:10 UTC on October 22nd, Spreek calculated that swETH carried 349.2 ETH of unbacked value and rswETH 232 ETH, and by October 23rd the rates were 6% and 5% above their clean values. The actor also redirected EigenLayer rewards on 40 rswETH StakerProxies to its own hub wallet, used a strategist key to move $392,891 of USDC inside a Swell HyperEVM vault to a sub-account it controlled, unset the proof-of-reserve oracle, and swept 0.92 ETH and 37.07 HYPE of gas. The main attack didn’t materialize: the four payloads targeting swEXIT, rswEXIT, and the two DepositManagers could only be installed through a seven-day timelock and a four-of-seven Safe.

Swell's timelock shows what happened next. On October 23rd at 11:47 UTC, five transactions were queued with an execution time of 7:32 UTC on October 31st: role revocations for the compromised bot address on both access-control managers and role grants to the Safe. No upgrade to the sweep payloads was queued. 

Swell acknowledged the activity on October 22nd and said no ETH had been withdrawn from or deposited into the affected contracts. On October 23rd it paused swETH and rswETH deposits and withdrawals, saying it was working with its security partners and Seal911, and that the next step was to return the net asset value to the correct figure, with no timeline. Press reports link the compromise to a leaked Railway key, which Railway has not publicly confirmed. Swell has not publicly confirmed the $392,891 movement or a recovery plan for the HyperEVM vault.