Where do your 24 words live?

Most of the crypto stolen or chased this week was taken without breaking a single blockchain. The chains did exactly what they were told. The trouble was who did the telling.

A blockchain can't tell an owner from a thief. It only checks for the right key, and your recovery phrase is that key. So the useful question after a week like this isn't "which coin is safe?" It's where your words were made, where they're kept, and who could get you to type them. This week, each of those places failed someone.

Where the words were made. Qubic, a smaller network, halted on October 18 after an attacker drained 1,404 wallets in about 104 minutes, roughly $1.3 million to $1.4 million. Qubic says its wallet software made some recovery phrases with weak randomness, in browsers on iPhones and in Safari on Macs, so they could be guessed. Nobody stole those words. They were predictable from the day they were made. Our report

Where the keys were kept. Railway, a company developers use to host apps and trading bots, says someone may have read and decrypted customers' stored settings between October 20 and 22. Wallets whose keys sat in those settings lost about $371,000 across more than 200 addresses, by researcher Taylor Monahan's count. Railway hasn't confirmed the link. A key on someone else's server is only as private as that server. Our report

Where you might be asked to type them. Security firm SlowMist flagged fake Ledger update pages that copy the real screens and end by asking for your 24 words. A Ledger owner in Germany got a posted letter with a QR code, saying wallets must be "registered" by October 31. No such rule exists. After this week's PHP2Shell server flaw, fake "security updates" told wallet users to re-enter their phrase, and Solana's Alpenglow upgrade brought "migrate your SOL" messages. Trust Wallet said it isn't affected by PHP2Shell. Solana holders had nothing to do. Every one of those requests was a thief asking politely. Fake Ledger letters · Fake PHP2Shell updates

Who else holds the keys. On October 20 the wallet behind April's $295 million Drift hack sent about 25,700 ether, roughly $61 million, through the Tornado Cash mixer. That hack didn't break Drift's code. Attackers tricked the people holding its admin keys into approving their transactions. One report puts victims' first repayments at about 1 cent per dollar. When you deposit on a platform, its key holders become part of your security. Our report

And sometimes it is the code. Initia halted its whole network on October 23 after a bug let an attacker mint tokens from nothing and move about $2.6 million to Ethereum. Holders can't move anything until it restarts, and nobody has said yet whether anyone will be made whole. You can't audit a young chain's code yourself. You can decide how much you keep on one. Our report

I've watched this market long enough to know the scary headlines rarely hit the people they're about. The quiet ones do: the phrase saved as a phone photo, the exchange key with withdrawals switched on, the letter that looked official enough. Here's the line I'd keep from this week.

Your coins don't live in your wallet. They live wherever your 24 words are.

Also this week

The US has frozen $938.5 million in scam crypto. Frozen isn't refunded. A court forfeiture case comes first, then a separate claims process that can take years. Anyone offering to speed up your share for a fee is running the next scam. Report losses at ic3.gov so you can be matched later. Our report

CoinDCX denies a new $16 million hack. The Indian exchange says about 15.99 million USDT left old wallets compromised in July 2025 and customer funds are fine. Investigators ZachXBT and Darcy point to recent links with its current wallets. It's unresolved, and we'll say so until it isn't. Our report

Schwab now sells bitcoin and ether to all eligible US clients. A trade costs 0.75%, so $7.50 on a $1,000 buy. The coins aren't covered by SIPC or the FDIC, Schwab says, unlike the stocks in the same account. Our report

Visa and Mesh plan crypto spending at 175 million stores. No launch date, wallet list or fees yet. Until your own wallet app offers it, any "early access" page is fake. Our report

This week on DMJ

 

 

 

 

 

 

Coming next week: guides for the hours after something goes wrong, including how to report a scam, whether stolen crypto can be traced, and what to do in the first hour after a recovery phrase leaks.

Loss figures in this issue are estimates from researchers and news reports unless a company or agency confirmed them. News and education, not financial advice. Tokens and NFTs can lose all their value.

DeFi Market Journal, PO Box 114, Belen, NM 87002