7 min read · 12 sources

CoinDCX has confirmed a $15.99 million USDT exploit on addresses the exchange claimed were decommissioned after its $44 million July 2025 compromise. The incident exposes an operational failure common to central exchanges running legacy wallet architectures: users kept sending funds to deprecated deposit addresses, an automated sweeping worker silently degraded, and funds pooled unmonitored at vulnerable contracts until drained.

The breach escalated after leadership called initial warnings from onchain monitors a “false alarm.” Public ledger analysis from ZachXBT revealed the exchange continued routing and sweeping deposits through the compromised setup through at least May 2026. While CoinDCX claims it absorbed the shortfall without pausing customer withdrawals, the event marks another operational failure for a team whose founders were arrested in March following a separate fraud complaint.

EIP-8037 modifies gas mechanics by refilling gas when storage slots are freed, breaking the 63/64 rule assumptions that DeFi error handlers rely on to catch nested execution failures.

Sweeper failures resurrect a decommissioned exchange surface

Source: theblock.co ↗

The CoinDCX $16 million loss stems from how centralized exchanges handle deposit address lifecycles. Standard operational infrastructure creates per-user forwarding or proxy addresses that trigger automated sweepers to move incoming tokens into unified cold storage pools. When CoinDCX suffered a $44 million breach in July 2025, it deprecated its existing deposit routing.

However, exchanges rarely enforce strict invalidation on client interfaces or inform older external address books cleanly. Users continued sending deposits to their old destination addresses. CoinDCX kept a legacy sweeping cron active to catch these stragglers, but when that job failed, the contract accumulated 15.99 million USDT over several months. FlashRescue first flagged unusual outflows from the contract. CEO Sumit Gupta initially dismissed the reports as false, but onchain logs proved the drained wallet was actively receiving and sweeping user funds well into 2026. Operators running sweeping microservices should treat this as a case study: if a set of keys or intermediate proxy contracts is flagged as compromised, sweeping must be actively monitored with hard alerting on un-swept balances rather than delegated to unmonitored scripts.

Glamsterdam gas limits stall on EIP-8037 refund bugs

Source: x.com ↗

Ethereum core developers have paused setting a firm release date for the upcoming Glamsterdam hard fork. Audit firm ChainSecurity disclosed that EIP-8037 and EIP-8038 introduce serious vulnerabilities affecting at least 13 live DeFi protocols. Glamsterdam aims to raise the block gas limit from 60M to 200M while containing state growth, but EIP-8037 alters core EVM execution guarantees.

EIP-8037 modifies gas mechanics by refilling gas when storage slots are freed, breaking the 63/64 rule assumptions that DeFi error handlers rely on to catch nested execution failures. Under EIP-150, an outer call retains 1/64th of the parent call’s gas, guaranteeing that an outer contract can catch an out-of-gas error in a child call and run fallback or recovery logic. By introducing dynamic refills mid-execution, child calls can alter the remaining gas budget unexpectedly, preventing outer error handlers from completing and leaving contracts in broken states.

Following the disclosure, teams from the Ethereum Foundation and Ethlabs deployed automated scanning agents to evaluate the mainnet contract registry. The agents used a collaborative GitHub coordination structure - claiming targets through issue comments, running symbolic analysis, and storing structured findings without human triage. The analysis paused Glamsterdam’s rollout and is now running against EIP-8198, which proposes reducing consensus slot times from 12s to 10s ahead of the Hegotá upgrade.

SoFi bridges FDIC insurance to EVM and Solana with SOFIE

Source: decrypt.co ↗

SoFi has rolled out SoFi Earn (SOFIE), marking the first direct consumer tokenized deposit from a US nationally chartered bank. SOFIE represents a $1 fiat balance held at SoFi Bank, carrying standard FDIC insurance pass-through protections while yielding 4.40% APY.

+------------------+         1:1 Conversion        +-----------------------+
|   SOFIE Token    | <===========================> |     SoFiUSD Token     |
| (Tokenized Dep.) |                               |  (Settlement Asset)   |
+------------------+                               +-----------------------+
         |                                                     |
         v                                                     v
  FDIC Insurance &                                     Ethereum & Solana L1s
    4.40% Yield                                        Mastercard Card Rails

The token resolves a structural limitation in corporate stablecoins: standard collateralized stablecoins (like USDC or USDT) cannot pay native yield to US retail holders without being classified as securities, leaving an estimated $64 billion in stablecoin assets idle. SOFIE bridges this gap by letting users convert their interest-bearing token 1:1 into SoFiUSD. SoFiUSD functions as a pure transactional stablecoin running on Ethereum and Solana, routing directly into Mastercard’s settlement network to clear card transactions. For protocol engineers, this design provides a blueprint for interfacing regulated banking balance sheets directly with public L1 liquidity pools.

Circle Match adds institutional rebate auctions to USDC issuance

Source: threadreaderapp.com ↗

Circle launched Circle Match, a batch-auction settlement engine for institutional Circle Mint customers. Rather than minting or redeeming USDC entirely against the issuer’s central treasury reserves, Match pools mint and redeem requests into hourly auctions.

The auction pairs institutional entities looking to acquire native USDC with market makers or desks looking to offload it for fiat wire settlement. When orders match within the system, redeeming participants exit at their specified limit pricing while minting participants receive a programmatic rebate. The base token contract, mint allowances, and collateral reserve requirements remain untouched; Circle is simply internalizing retail-versus-institutional order flow to lower wire and settlement overhead.

Base expands agent payment infra and institutional collateral

Source: x.com ↗

Base continues to push developer adoption across automated payments and lending integrations, according to its latest ecosystem update. Technical highlights include:

• Agent Pay for Machines: Mastercard and Cloudflare shipped an implementation of the x402 payment protocol on Base, allowing autonomous AI agents to clear microtransactions for computational resources, APIs, and infrastructure using stablecoins without human billing approval.
• Morpho Midnight Deposits: Total deposits on Morpho Midnight crossed $100M, reinforced by Spark Finance injecting over $400M in USDC liquidity into Morpho’s cbBTC/USDC lending markets.
• Tokenized Stock Collateral: Users holding tokenized “Magnificent 7” equities deposited $9.57M and drew down $4.08M in USDC loans on Aave V4, with telemetry showing 75% of these depositors were entirely new addresses to the protocol.
• Cross-Border Payouts: Payment infrastructure provider Thunes plugged stablecoin settlement rails into its payment routing engine, while Frax introduced multi-currency foreign exchange pairs on the Aerodrome DEX.

Perp-to-options mechanics challenge structural leverage risk

Source: x.com ↗

A new architectural paper on onchain derivatives mechanics argues that structural flaws in perpetual futures will shift volumes into onchain options protocols. Analyzing Bitcoin daily price closes between 2018 and 2026, the data shows that a standard 10x perp long suffered a 47% liquidation rate over a 180-day holding period - even on trades where the asset price ultimately finished higher than the entry point.

Perp liquidations trigger on intra-candle wick volatility, creating severe path dependency for long-horizon position sizing. Options eliminate intra-period liquidation entirely, requiring settlement only at expiration. The research notes that onchain options volume (currently ~$5B notional monthly, dominated by Derive with over 90% of onchain premiums) will scale through symbiotic integration rather than competition: options makers hedge net-delta exposure using perpetual swaps. This dynamic, already proven by Deribit’s $2B+ in perp open interest driven strictly by options desks, is expected to concentrate liquidity on perp execution engines like Hyperliquid, Derive, and Paradex.

Keystone shipping data compromised via Shopify integration

Source: threadreaderapp.com ↗

Hardware wallet maker Keystone confirmed a customer data breach detected on October 20. An unauthorized third party gained access to customer order databases by targeting Keystone’s Shopify API integrations.

The exposed records include customer names, physical delivery addresses, phone numbers, emails, and specific order manifests. Keystone emphasized that device firmware, private keys, seed phrases, and payment processing details were not held on the compromised system and remain intact. The technical risk centers entirely on targeted phishing and physical vector attacks. Operators and users who ordered devices directly should expect sophisticated phishing campaigns using spoofed domain names, fake replacement notices, or fraudulent firmware update prompts that leverage the stolen order metadata.

Tools, deployments, and protocol notes

Source: threadreaderapp.com ↗

A quick pass over the remaining deployments and parameter adjustments moving through the stack this week:

• Hyperliquid Terminal Hypurrdash: Released a new execution interface supporting private TWAP routing, automated order swarms, real-time liquidation heatmaps, and VWAP algos on HyperEVM.
• Aave V4 Tokenized Stocks: Tokenized Coinbase stock (COIN) deposits on Aave V4 crossed $10M on Base, tracking a 514% deposit increase over the trailing 30 days.
• Aave USDT Borrow Caps: Aave governance lowered the optimal utilization rate (U-optimal) for the mainnet Ethereum USDT market from 94% to 92%, steepening the borrow interest rate slope to curb protocol illiquidity during rapid market selloffs.
• Silhouette Perps RFQ: Rolled out an institutional request-for-quote (RFQ) mechanism for BTC and HYPE perpetual contracts on Hyperliquid, handling trade sizes up to $100,000 per quote without slippage on the order book.
• 2Factor Finance: Deployed an architecture offering fixed 1.33x exposure on Bitcoin on Base without an automated liquidation price, collateralizing positions through zero-liquidation debt vaults.