Old keys, open doors: CoinDCX, Zilliqa X-Bridge and Keystone in one week

In the same week CoinDCX said a deprecated wallet still absorbed 15.99 million USDT, Le Coin's Ethereum read of Zilliqa's X-Bridge showed four withdrawals from a one-address validator set, and Keystone said a Shopify-side breach reached customer shipping and order records [1][2][3][6]. The common thread is descriptive, not ranked: in each case the exposed part was infrastructure that was supposed to be retired, minimal, or offline.

CoinDCX: a deprecated wallet that still received

On Oct. 25 CoinDCX published an update on on-chain activity tied to a wallet beginning TQKJQ [1]. The company said the wallet "belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result" [1]. Unusual activity was noticed Oct. 21; the next day, CoinDCX said, irregular fund movement hit that deprecated infrastructure, "which had unknown vulnerabilities" [1]. An automated sweeping service had failed for a period, deposits accumulated in the deprecated address, and "this led to a loss of 15.99 million USDT which was absorbed by the company" [1].

CoinDCX describes residual infrastructure from the 2025 incident, not a fresh breach of its active stack. It says active systems were not paused, user funds in segregated cold wallets "remain safe," and that it credits mistaken deposits to the old address at once before sweeping them separately [1]. "We could have been more proactive," it wrote [1]. Le Coin does not call the Oct. 21 activity a "new" or "second" hack in its own voice.

Zilliqa X-Bridge: one signature met the bar

Ethereum block 26,144,997, mined at 03:29:23 UTC on Oct. 8 (11:29 p.m. ET Oct. 7), contains four successful calls from 0x29cd…9572 to the Ethereum chain gateway 0x49ea…69c3 [3][4]. Receipts show about 343,801 USDT, 79,371 USDC, 5.16344432 WBTC, and an XCAD balance left the LockAndRelease token manager 0x2ee8…ede5 [3][4]. At that block, getValidators() on the validator manager returned exactly one address: the same 0x29cd…9572 that sent the four transactions [3]. A later Le Coin read returned a different single address, 0x092a…a3a8 [3]. Stables sum to about $423,000; at CoinMarketCap's Oct. 8 bitcoin price of $81,676, the WBTC is about $422,000, for about $845,000 before XCAD [3][5].

In Zilliqa's UCCB design, cross-chain messages dispatch only after a supermajority of the bridge validator set has signed [4]. When that set has one member, one signature meets a two-thirds-style threshold. That is a description of the mechanism on the chain Le Coin read, not a claim about who held the key.

Zilliqa said at 8:19 a.m. ET on Oct. 25 that it had engaged "a leading firm from the crypto space, specialised in cybersecurity and AI-driven attacks," to help investigate "the situation" [2]. The post does not name a bridge, a loss figure, or the firm. It followed days of user posts about X-Bridge. Le Coin is not tying that statement to the Oct. 8 withdrawals in Zilliqa's voice until Zilliqa confirms the link and names the firm [2][3].

Keystone: shipping data beside self-custody

Keystone Hardware Wallet says unauthorized access to its official website, detected Oct. 20, led to confirmation on Oct. 23 that a third party obtained Shopify shipping and order records, and the company disclosed the incident on Oct. 24 [6]. Keystone lists what was obtained: names, contact details, shipping addresses, and order details (items and prices) [6]. It separately lists what was not: payment card or bank details, recovery phrases, private keys, or wallet passwords [6]. A hardware wallet keeps signing keys offline; the ecommerce layer still holds who ordered and where to deliver. When that record leaves the merchant's control, the leak maps likely self-custody households rather than seeds. Keystone says it blocked access, fixed the vulnerability, opened an investigation, and is emailing affected customers; it has not published a headcount [6]. Le Coin's earlier piece stands; this week places Keystone beside the two on-chain residual-key cases without restating customer claims as fact.

Side by side

No dollar total across the three. The table is a schedule of what each party said or what the chain shows, not a ranking.

The objection

A fair objection is that these are different failure modes (exchange deposit routing, bridge validator design, ecommerce data) and should not share a frame [1][3][6]. Another is that Zilliqa's Oct. 25 post never says "X-Bridge" or "$845,000," so pairing it with the Oct. 8 withdrawals is Le Coin's sequencing plus an independent chain read [2][3]. Both limits stand. No shared attacker, method, or dollar figure is claimed.

The tell

In Le Coin's view, the tell is whether each party publishes what remains live after the disclosure: CoinDCX on how long deprecated addresses stay credited and swept; Zilliqa on the firm, whether the engagement covers the Oct. 8 withdrawals, and the current validator set and threshold; Keystone on the fuller incident report and headcount it has said is coming [1][2][3][6]. Until those records thicken, the checkable facts are the three accounts above.

Sources

1. CoinDCX, "Update on the on-chain Wallet Activity - 21st October 2026," Oct. 25, 2026, https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026 ; TQKJQ old operational wallet infrastructure compromised in the July 19, 2025 incident and deprecated; "unknown vulnerabilities"; sweeping failure; "loss of 15.99 million USDT which was absorbed by the company"; user funds remain safe; "We could have been more proactive"; accessed Oct. 25, 2026, ~12:10 p.m. ET.
2. Zilliqa (@zilliqa), post on X, Oct. 25, 2026, 8:19 a.m. ET, https://x.com/zilliqa/status/2114330935495967099 ; engaged a leading crypto firm "specialised in cybersecurity and AI-driven attacks" to investigate "the situation"; does not name bridge, loss, or firm; accessed Oct. 25, 2026, ~9:19 a.m. ET.
3. Ethereum block 26,144,997, timestamp 2026-10-08T03:29:23Z; four txs from 0x29cd9c758239259a15792591a9aa64667a409572 to chain gateway 0x49ea20823c953dd00619e2090dfa3965c89269c3; ERC-20 transfers from token manager 0x2ee8e8d7c113bb7c180f4755f06ed50be53bede5 (about 343,801 USDT, 79,371 USDC, 5.16344432 WBTC, plus XCAD). Validator manager getValidators() at that block returned [0x29cd…9572]; later read returned [0x092a…a3a8]. Le Coin eth.drpc.org read ~9:10 a.m. ET Oct. 25. https://etherscan.io/block/26144997
4. Zilliqa/xbridge, production bridge-web/src/config/config.ts (ethereum chainGatewayAddress 0x49EA20823c953dd00619E2090DFa3965C89269C3; LockAndRelease tokenManagerAddress 0x2EE8e8D7C113Bb7c180f4755f06ed50bE53BEDe5); README: remote calls dispatch with supermajority validator signatures; validator set via getValidators(). https://github.com/Zilliqa/xbridge ; accessed Oct. 25, 2026, ~9:19 a.m. ET.
5. CoinMarketCap BTC price Oct. 8, 2026, $81,676; WBTC 5.16344432 × $81,676 ≈ $422K; stables ≈ $423K; combined ≈ $845K before XCAD. https://coinmarketcap.com
6. Keystone Hardware Wallet (@KeystoneWallet), X statement, Oct. 24, 2026, 1:59 p.m. ET, https://x.com/KeystoneWallet/status/2114054080754770137 ; Oct. 20 detection, Oct. 23 Shopify confirmation, exposed/not-exposed lists; accessed Oct. 24, 2026, 6:21 p.m. ET.

Holding the Corner.

Not financial advice.