August 2026 Web3 Hack Recap: 50 Attacks, $136M Lost, and a Chain Rolled Back" ## TL;DR August 2026 was the busiest month for attackers all year and one of the cheaper ones for victims. Trackers counted around 50 incidents, the highest monthly total of 2026, while realized losses fell roughly half from July to about $136 million. The average incident shrank from about $9 million to about $2.7 million. One event dominated: an attacker pumped Tectonic's thinly traded TONIC token roughly 100x in twenty minutes, posted it as collateral, and borrowed about $74 million of real assets from the Cronos lending market. Cronos validators halted the entire chain and rolled it back, stranding most of the proceeds. Three days earlier, Moonwell on Base lost about $8.7 million to the identical playbook. Below the headline, the month was defined by failures beneath the application layer: a four-month-old integer underflow in Cosmos EVM drained six chains, Harmony minted 4 billion tokens out of nothing, Injective's binary options settlement fell to a market identifier collision, and BounceBit shut down its L1 after a $3 million authorization flaw. Governance failed again at Term Finance, where about 0.5 ETH of voting power controlled $8.5 million. And a single phished whale lost $25.6 million, the second largest loss of the month, without a contract ever being touched. The lesson of August is that no line of Solidity broke in the two largest protocol exploits. The collateral parameters did. [Get your protocol audited before you become next month's headline →](https://app.cecuro.ai/auth?mode=signup) --- ## The Numbers That Define August 2026 August inverted July. Fewer dollars, far more attacks. The most widely cited tally puts the month at 50 major incidents and $136.3 million in losses, a 67 percent jump in incident count from July's 30 and a 49 percent drop in dollars from July's roughly $270 million as later revised. A DeFi-only count landed close by at about $139.7 million. A broader count that includes phishing and individual wallet compromise reached about $215 million, though that figure books Tectonic at its $120.4 million gross borrow value rather than the roughly $74 million actually extracted, and includes $41.5 million of phishing losses that protocol-focused trackers exclude. As always, the gap is definitional rather than factual. We use $136 million as the headline and note the range. Two numbers matter more than the total. First, concentration: Tectonic alone was more than half of every tracker's figure, and the ten largest incidents were about 90 percent of it. Second, category: by dollars, price and collateral manipulation dominated at roughly $83 million across the protocol-focused counts and over $130 million in the broader ones. Code vulnerabilities in the classic sense, a broken `require` or a reentrancy path, were a small fraction. The money left through parameters, oracles, quorums, and keys. Two corrections to early reporting are worth flagging because they change the ranking. More Markets on Flow EVM was reported as a $9.3 million exploit on August 31; the monitoring firm that raised the alert corrected it on September 2 to about $410,000 at spot, of which the attacker realized roughly $246,000 after slippage. And TAC, initially reported as a standalone $7.5 million contract exploit, was one of six chains drained by the same Cosmos EVM underflow. The gross value transferred was about $7.5 million; the attacker realized under $1 million on sale before the chain froze. --- ## The Big Story: Tectonic and the Collateral That Priced Itself **Loss:** ~$74 million extracted, of which about $6 million escaped Cronos **Date:** August 30, 2026 **Attack type:** Collateral price manipulation of an illiquid governance token Tectonic was the largest lending market on Cronos, holding around $122 million in total value locked and $83 million in outstanding loans immediately before the attack, close to half of all capital on the chain. Its own governance token, TONIC, was accepted as collateral. TONIC had roughly $1.34 million of on-chain liquidity and about $11,000 of daily trading volume. The attacker spent an estimated $600,000 buying TONIC across the thin pools, driving the price up about 100x in around twenty minutes. The oracle reported that price accurately, because it was the price. The attacker then supplied 364.6 trillion inflated TONIC as collateral and borrowed real, liquid assets out of the lending pools, roughly $74 million by the time the pools were empty. TONIC collapsed, the positions went underwater, and there was nothing left to liquidate into. Cronos validators did something almost no L1 has done in response to a DeFi exploit. They halted block production across the entire network within minutes, freezing transfers, bridges, and every contract on the chain. Roughly $6 million had already been bridged to Ethereum and was gone. The remaining $60 to $68 million sat frozen at Cronos addresses. Validators then restored the chain from a snapshot taken before the exploit, discarding roughly 11,000 blocks of history, and resumed producing blocks at 23:49 UTC the same day. Tectonic's TVL fell from over $121 million to around $3 million within days regardless. The oracle provider's position, stated publicly, was that the feed did its job and the failure was in Tectonic's collateral controls. That is the correct diagnosis. A price feed cannot protect a market from a price that is genuinely being paid on-chain. What protects the market is a cap on how much can be borrowed against an asset, sized against how much of that asset could actually be sold to cover the debt. ```solidity // ❌ VULNERABLE: collateral is valued at the raw oracle price with no // relationship to how much of the asset could actually be liquidated. // If an attacker can move the spot price, they can mint borrowing power. function collateralValue(address user, address asset) public view returns (uint256) { uint256 price = oracle.getPrice(asset); return supplied[user][asset] * price / 1e18; } function borrow(address asset, uint256 amount) external { require(totalCollateralValue(msg.sender) * LTV_BPS / 10_000 >= debt(msg.sender) + amount, "undercollateralized"); _lend(msg.sender, asset, amount); } ``` ```solidity // ✅ HARDENED: bound the price against a time-weighted reference, and cap // total borrowing against each collateral asset at a fraction of the // liquidity that could actually absorb a liquidation. function collateralValue(address user, address asset) public view returns (uint256) { uint256 spot = oracle.getPrice(asset); uint256 twap = twapOracle.consult(asset, 30 minutes); // A 100x move in twenty minutes should never be accepted at face value. uint256 price = spot > twap ? twap : spot; return supplied[user][asset] * price / 1e18; } function borrow(address asset, uint256 amount) external { require(totalCollateralValue(msg.sender) * LTV_BPS / 10_000 >= debt(msg.sender) + amount, "undercollateralized"); // Per-collateral debt ceiling sized to executable on-chain liquidity, // recomputed by governance or a keeper as liquidity changes. for (uint256 i = 0; i < userCollaterals[msg.sender].length; i++) { address c = userCollaterals[msg.sender][i]; require(debtBackedBy[c] + amount <= liquidityCap[c], "collateral debt ceiling"); } _lend(msg.sender, asset, amount); } ``` **Key lesson:** Any protocol that accepts its own low-liquidity governance token as collateral has built a self-referential loop that a moderately capitalized attacker can close. The fix is not a better oracle. It is a debt ceiling per collateral asset tied to executable liquidity, a TWAP bound on accepted prices, and a rule that governance tokens with under a few million dollars of depth do not get to back nine-figure borrowing at all. The containment also sets a precedent the industry will argue about for years: a production L1 demonstrated that history is negotiable when enough validators agree. Recovery that depends on a validator set small and coordinated enough to halt a chain in minutes is not a security model most protocols can count on. --- ## Moonwell: The Same Playbook, Three Days Earlier **Loss:** ~$8.7 million (gross borrows of $11.03 million) **Date:** August 27, 2026, between 06:09 and 09:30 UTC **Attack type:** Spot oracle manipulation on illiquid collateral, with a supply cap bypass If Tectonic was the month's largest exploit, Moonwell was its clearest warning, and it arrived three days before anyone acted on it. The attacker bought about 94.31 million MAMO across several DEXes on Base. Because liquidity was thin, the purchases drove the MAMO/USD feed from about $0.0106 to a peak of $0.4313, a roughly 40x increase. Moonwell had assigned MAMO a 50 percent collateral factor. At the peak accepted price of $0.4025, the attacker's MAMO was valued at about $22.34 million, producing roughly $11.17 million of borrowing capacity. The detail that makes this a code lesson rather than only a parameter lesson: Moonwell had a supply cap on MAMO. The attacker supplied about 15.09 million MAMO through the normal path, under the cap, and then transferred another 53.39 million MAMO directly to the market contract. In a Compound-style market the supply cap is checked at mint time against the value of shares outstanding, and a direct transfer of underlying raises the exchange rate of every existing share. The attacker's position quietly became worth 68 million MAMO without ever tripping the cap. Eighteen borrows later, $11.03 million in cbBTC, WETH, USDC, and wstETH was gone, and about $8.73 million in USDC had been moved to Ethereum. Moonwell's response was to set borrow caps on every Base core market, and supply caps on MAMO and WELL, to one wei. This was Moonwell's third security failure in eleven months, and the loss exceeded the protocol's full annual revenue. ```solidity // ❌ VULNERABLE: cap enforced only at mint time, against a value derived // from the market's underlying balance. Tokens sent directly to the market // raise every holder's redeemable amount without touching this check. function mint(uint256 mintAmount) external { uint256 totalUnderlying = totalSupply * exchangeRateStored() / 1e18; require(totalUnderlying + mintAmount <= supplyCap, "supply cap"); // exchangeRate = (cash + borrows - reserves) / totalSupply // cash = underlying.balanceOf(address(this)) <-- attacker can inflate this _mint(msg.sender, mintAmount * 1e18 / exchangeRateStored()); } ``` ```solidity // ✅ HARDENED: track supplied principal explicitly, price collateral off // tracked principal rather than contract balance, and re-check the cap // wherever collateral value is consumed. mapping(address => uint256) public trackedSupply; function mint(uint256 mintAmount) external { require(trackedSupply[asset] + mintAmount <= supplyCap, "supply cap"); trackedSupply[asset] += mintAmount; principal[msg.sender] += mintAmount; underlying.safeTransferFrom(msg.sender, address(this), mintAmount); } function collateralValue(address user) public view returns (uint256) { // Value is a function of what the user actually supplied, not of // whatever balance happens to sit in the contract. uint256 price = _boundedPrice(asset); return principal[user] * price / 1e18; } // Excess balance above tracked supply is treated as donation, not collateral. function skim(address to) external onlyGovernance { uint256 excess = underlying.balanceOf(address(this)) - trackedSupply[asset]; underlying.safeTransfer(to, excess); } ``` **Key lesson:** Once a technique works in public, expect it to be replayed against every protocol sharing the pattern within the same week. Moonwell on August 27 and Tectonic on August 30 were the same attack with different tickers. A supply cap that can be bypassed by a direct transfer is not a supply cap, and real-time monitoring that flags a 40x move on a collateral asset is the difference between a capped loss and a full drain. --- ## Governance: Term Finance and the Vote That Cost 0.5 ETH **Loss:** ~$8.5 million (about 2,843 ETH and 1.68 million USDC) **Date:** August 23, 2026 **Attack type:** Governance takeover via a custom voting wrapper Term Finance's Meta Vaults ran on Yearn V3 vault infrastructure with a custom governance layer built by Term Labs on top. That layer is where the failure lived. Yearn stated publicly that standard Yearn vaults were not affected. Vault depositors could wrap their LP shares into governance tokens to vote on vault strategy. Almost nobody did. At the snapshot for the attacker's proposals, the entire governance token supply for the Ethereum Meta Vault was 0.535 gtmvETH. The attacker deposited roughly 0.5 ETH, wrapped it, and held 90.66 percent of the active electorate. In four of the five USDC strategy vaults, the attacker held 100 percent of voting power. Initial funding was 2 ETH through Tornado Cash, and one tracker priced the governance position at about $951. Term had a seven-day timelock and a liquidity-provider veto. Neither stopped the proposals, because participation thresholds were measured against the wrapped governance supply rather than total vault shares outstanding, and the attacker was the wrapped supply. The proposals redirected vault assets, executed, and drained about 68 percent of the affected vaults. Term Labs recovered every affected fixed-rate loan position by August 25, permanently shut down Meta Vault deposits, revoked DAO governance roles, and kept withdrawals open. ```solidity // ❌ VULNERABLE: quorum is measured against the wrapped governance supply. // If only one depositor bothers to wrap, that depositor is the quorum. function _quorumReached(uint256 proposalId) internal view returns (bool) { Proposal storage p = proposals[proposalId]; uint256 base = govToken.getPastTotalSupply(p.snapshotBlock); // 0.535 gtmvETH return p.forVotes * 10_000 / base >= QUORUM_BPS; } ``` ```solidity // ✅ HARDENED: measure quorum against all vault shares, wrapped or not, // and require an absolute floor so a near-empty electorate cannot move funds. function _quorumReached(uint256 proposalId) internal view returns (bool) { Proposal storage p = proposals[proposalId]; // Every depositor's economic stake counts toward the denominator, // whether or not they chose to wrap and vote. uint256 base = vault.getPastTotalSupply(p.snapshotBlock); if (p.forVotes < MIN_ABSOLUTE_VOTES) return false; return p.forVotes * 10_000 / base >= QUORUM_BPS; } // Proposals that move funds out of the vault also need a guardian // confirmation during the timelock, not only the absence of a veto. function execute(uint256 proposalId) external { Proposal storage p = proposals[proposalId]; require(block.timestamp >= p.eta, "timelock"); if (p.movesFunds) require(guardianApproved[proposalId], "guardian"); _execute(p); } ``` **Key lesson:** July's BonkDAO drain cost the attacker $4.4 million of tokens. August's Term drain cost roughly a thousand dollars. Governance is attack surface, and the cost of attack has to be calculated against the value the vote controls. A quorum measured against whoever showed up is not a quorum. The denominator has to be everyone with money at stake, with an absolute floor, and any proposal that can move funds needs an affirmative check during the timelock rather than only a veto that nobody is watching for. [Audit your governance and collateral parameters with Cecuro →](https://app.cecuro.ai/auth?mode=signup) --- ## Chain-Level Failures: When the Bug Lives Below the Contract August's most important technical story was not any single protocol. It was that five separate L1 incidents traced to flaws in chain modules, shared frameworks, or core settlement logic rather than application code. ### Cosmos EVM: One Underflow, Six Chains, Four Months of Warning **Loss:** ~$5.7 million realized; ~$14.8 million gross across the three disclosed chains **Dates:** August 20 to 25, 2026 **Attack type:** Integer underflow in balance reconciliation between EVM state and Cosmos vesting accounts Cosmos EVM is the Ethereum-compatible framework many Cosmos chains run, descended from the Evmos codebase. Its state database tracks a single spendable balance per account. The underlying Cosmos SDK, however, gives vesting accounts two balances: spendable and locked. Locked tokens cannot be transferred, but they can be delegated to a validator. That mismatch was the bug. When a vesting account delegated more than its spendable balance, the EVM layer subtracted the delegated amount from the spendable balance it knew about, with no check that the result stayed non-negative. The value wrapped to roughly 2^256. The attacker precomputed a contract deployment address, created a vesting account there, deployed a malicious contract, delegated to trigger the underflow, and transferred the enormous phantom balance in a single supply-neutral transaction that overflowed victim balances and netted the attacker real tokens. The timeline is the part every team should read twice. The flaw was reported through the Cosmos bug bounty on April 25. A fix was merged to the main branch on May 15 through a silent patch process. The security team had concluded that the vulnerability only affected chains using non-18-decimal configurations, and since every known production Cosmos EVM network used 18 decimals, it decided user funds were not at risk and did not distribute a private advisory. Independent researchers established in early August that every Cosmos EVM chain was affected. An obscured patch shipped on August 19. A public exploit description appeared at 07:16 UTC on August 20. The first attack, on MANTRA, began at 19:06 UTC the same day, about twenty hours after the patch. TAC and KiiChain were exploited on August 22. Six chains in total were drained, including MANTRA (about $3.6 million), TAC (about 2.986 billion TAC transferred from the staking pool, roughly $7.5 million gross, under $1 million realized), KiiChain (about $1.6 million), and Nesa (about $60,000). Cosmos Labs coordinated with forty chains during the response and later acknowledged in its post mortem that its original risk assessment was wrong. MANTRA halted, patched, and resumed with user balances unaffected; the loss was confined to two team-managed wallets. TAC paused at block 24,671,475, remained frozen for more than ten days, and required a 1.26 billion token bailout of its staking pool. ```go // ❌ VULNERABLE: the EVM StateDB only knows about spendable balance. // A vesting account can delegate its locked balance too, so this // subtraction can exceed what StateDB thinks the account holds. func (s *StateDB) SubBalance(addr common.Address, amount *uint256.Int) { so := s.getOrNewStateObject(addr) so.SubBalance(amount) // unchecked: 0 - 1 wraps to 2^256 - 1 } ``` ```go // ✅ HARDENED: reconcile against the full account state and refuse // any subtraction the spendable balance cannot cover. func (s *StateDB) SubBalance(addr common.Address, amount *uint256.Int) error { so := s.getOrNewStateObject(addr) if so.Balance().Lt(amount) { return ErrInsufficientBalance } so.SubBalance(amount) return nil } ``` **Key lesson:** Supply chain risk is chain-level risk. Every framework, module, and precompile you did not write is part of your security surface, and a shared dependency turns one bug into a synchronized multi-chain incident. The disclosure failure is a lesson of its own: a fix merged silently is a fix attackers can diff. If a patch ships, the advisory has to ship to operators first, privately, with a clear severity, regardless of whether the reporting team could reproduce the exploit on a particular configuration. ### BounceBit: A $3 Million Exploit That Ended an L1 **Loss:** ~$3 million (286.5 million BB) **Date:** August 19 to 20, 2026 **Attack type:** Authorization flaw in the vesting and lockup module inherited from Evmos Hours before the first Cosmos EVM attack, BounceBit Chain was hit through a different flaw in the same lineage. A native vesting and lockup module inherited from the Evmos stack let a smart contract caller specify another account as the source of funds without the module verifying that the account had authorized the transfer. Fourteen transactions across nine mainnet accounts moved about 286.5 million BB between 21:02 UTC on August 19 and 01:54 UTC on August 20. On August 21, BounceBit announced it would permanently shut down its standalone L1 and reissue BB as a BEP-20 token on BNB Chain from a pre-attack snapshot, excluding the stolen tokens. The team said rebuilding was impractical because Evmos itself had been discontinued earlier in 2026. **Key lesson:** For a smaller chain, the reputational and operational cost of a breach routinely exceeds the dollars stolen. A $3 million exploit ended a network. Running a discontinued framework is running unpatched code, and pre-deployment review of the base layer, not just the applications on it, is the cheaper option by a wide margin. ### Harmony: 4 Billion ONE From Empty Blocks **Loss:** ~$3.2 million at post-incident prices (4 billion ONE, about 26 percent of supply) **Date:** August 12, 2026 **Attack type:** Unauthorized native token minting via forged cross-shard transactions Harmony confirmed an unauthorized mint of about 4 billion ONE on its mainnet at roughly 05:25 UTC on August 12. Early analysis pointed to forged cross-shard transactions and credits attached to empty blocks, and the chain's total supply endpoint did not immediately reflect the increase, which masked the mint. Around 97 percent of the minted tokens reached exchanges before freezes took hold. ONE fell about 37 percent within a day. Harmony paused its bridge, developed an emergency patch, and coordinated with exchanges on freezes. This is Harmony's second major incident after the 2022 Horizon bridge theft. **Key lesson:** Monitoring supply is a security control. A native mint that does not show up in total supply is a chain whose own instrumentation cannot detect an attack on itself. ### Injective: A Market ID Collision, and a Bug Class We Wrote About Last Month **Loss:** ~$4.9 million (roughly 1,900 ETH after bridging and swaps) **Date:** August 31, 2026 **Attack type:** Identifier collision in binary options settlement logic Injective derives a market identifier by hashing the concatenation of oracle type, ticker, quote denomination, oracle symbol, and oracle provider, with no separators or length prefixes between fields. That is a non-injective encoding: two different sets of inputs can produce the same identifier. The attacker used it to create an INJ-denominated insurance fund whose identifier collided with a USDC-denominated binary options market, then opened 299 short-lived markets with an oracle configured to fail at settlement. When settlement fell into the no-price refund path, the protocol tried to cover a manufactured USDC deficit from the raw integer balance of the attached INJ fund, paying out far more than was deposited. Proceeds were bridged to Ethereum via CCTP, swapped to ETH on Uniswap, and consolidated into a single wallet. Block production stopped for about three hours and forty-two minutes while validators shipped an emergency release that added an insurance fund denomination check and disabled binary options settlement on mainnet. Injective's foundation described the event as a network upgrade rather than a halt, which on-chain researchers disputed. July's Wanchain bridge exploit was the same bug class: fourteen fields concatenated without delimiters let one signature authorize a 65,000x larger withdrawal. The Solidity analogue is the difference between `abi.encodePacked` and `abi.encode` when hashing more than one variable-length field. ```solidity // ❌ VULNERABLE: concatenating variable-length fields with no delimiters. // ("INJ", "USDC-BO") and ("INJU", "SDC-BO") hash to the same identifier. bytes32 marketId = keccak256(abi.encodePacked(oracleType, ticker, quoteDenom, oracleSymbol, oracleProvider)); ``` ```solidity // ✅ HARDENED: abi.encode pads and length-prefixes every field, so // distinct inputs always produce distinct identifiers. Then check the // denomination explicitly rather than trusting the identifier alone. bytes32 marketId = keccak256(abi.encode(oracleType, ticker, quoteDenom, oracleSymbol, oracleProvider)); require(insuranceFund[marketId].denom == quoteDenom, "insurance fund denom mismatch"); ``` **Key lesson:** Ambiguous encoding is a well-documented, trivially avoidable bug class, and it produced two seven-figure incidents in consecutive months. Fuzz every identifier and signed-message encoder to prove that no two distinct inputs collide. Disclosure quality is also part of security posture; calling a halt an upgrade erodes the trust that incident response depends on. ### Ontology: A Halt With No Confirmed Loss Ontology froze mainnet block production on August 31 at roughly block 20,770,893 over a security concern flagged about ten days after a v3.1.2 upgrade that added EVM opcodes. No breach or user loss had been confirmed at time of writing, and the team said it stopped production before identifying an incident. Precautionary halts are the right call when a chain cannot yet rule out a live exploit, and Ontology's is a useful contrast with Injective's framing. --- ## The User and Key Layer: Where the Second-Largest Loss Came From **Individual whale wallet ($25.6 million, August 12):** One high-value private wallet was drained of $25.6 million in WBTC, cbBTC, LDO, USDS, and CRV after signing a malicious approval, with proceeds swapped to DAI and ETH. The same wallet lost $24.23 million to a near-identical attack in September 2023, when the attacker returned about 90 percent. This time nothing came back. It was the second largest loss of the month and it involved no protocol vulnerability. Transaction simulation, approval hygiene, and hardware isolation are a separate discipline from contract security, and in August the user layer cost more than every smart contract exploit except Tectonic. **Coinsbuy ($7.9 million, August 9):** Wallets tied to the crypto payment platform were drained across Ethereum and TRON almost simultaneously, then routed through exchanges into Monero. Simultaneous drains across two chains point to compromised operational keys, not a contract flaw. This echoes July's Triple-A incident: key management and signing infrastructure are now as material to payment processors as contract security is to protocols. **Fogo ($3.9 million, August 29):** The Solana Virtual Machine L1 halted its mainnet after about 400 million FOGO, roughly 4 percent of supply, moved from foundation-controlled wallets to an attacker. The likely vector was a leaked key or cloud infrastructure flaw. Validators upgraded the network and 237 million of the tokens were later recovered and permanently removed from supply. **Aquifer (~$2.5 million, August 31):** The Solana automated market maker lost about $2.5 million from wallets on Solana and Ethereum. No evidence had emerged that its contracts were exploited; compromised wallet access was the working theory. Aquifer's upgrade authority published a cryptographically signed on-chain whitehat offer directly to the attacker's addresses, offering 20 percent retention for the return of at least 80 percent by September 3. Negotiating on-chain with a signed offer is a response pattern worth copying. **RRWallet (~$2 million, August 6):** The open-source multi-currency wallet generated seed phrases using a weak random number generator in a bundled JavaScript library, making private keys predictable. At least one user lost about $2 million. This is Coldcard's failure class one month later in a different wallet. **Coldcard, carried over from July:** The hardware wallet entropy flaw that opened July's recap kept sweeping into August. Galaxy Research flagged a third wave on August 2, pushing the running total to about 1,367 BTC, roughly $89 million, from 4,585 addresses, with later estimates ranging higher as additional waves were attributed. A March 2021 firmware change routed seed generation to a deterministic software PRNG instead of the hardware RNG, leaving about 40 bits of effective entropy. Patching does not repair a seed that has already been generated. Cryptographic primitives, especially randomness, deserve periodic re-review rather than one-time sign-off. --- ## Maya Protocol: Six Bugs, One Transaction **Loss:** ~$1.7 million extracted; about $11 million in pool value destroyed **Date:** August 18, 2026 **Attack type:** Six chained accounting flaws producing a phantom pool balance The most technically sophisticated attack of the month was also among the cheapest in absolute terms. A single transaction containing 23 messages chained six individually minor flaws. A faulty compensation mechanism credited roughly 49 million CACAO against a reserve holding about 168,000. A second bug let the inflated balance persist after a failed transfer. The attacker then took over 99 percent of the distorted pool and withdrew 48.87 million CACAO, swapping into BTC and other assets. CACAO fell about 89 percent and pool value dropped by roughly $11 million against $1.7 million actually extracted. The founder halted the network pending a fix. **Key lesson:** None of the six bugs was critical on its own. Composed, they were. Unit-level review that clears each function in isolation will miss this class entirely. It takes invariant testing across state transitions: the reserve can never credit more than it holds, a failed transfer can never leave a balance changed, and a single message sequence can never move a pool from solvent to empty. --- ## The Correction: More Markets and the $9.3 Million That Was $410,000 **Loss:** ~$410,000 at spot, ~$246,000 realized (initially reported as $9.3 million) **Date:** August 31, 2026 **Attack type:** Unbacked liquid staking token minted upstream, passed through a lending integration Early reporting placed More Markets on Flow EVM as the month's third largest exploit at $9.3 million. The monitoring firm that raised the alert corrected it on September 2, and the Flow Foundation corroborated the correction: the original figure was an initial detector estimate, not the spot value of what was removed. What actually happened is more interesting than the wrong number. A flaw in Ankr's ankrFLOW liquid staking contract let the attacker create about 8.6 million ankrFLOW with no FLOW backing. The attacker posted it as collateral on More Markets, used Aave V3's efficiency mode, which raises borrowing power for assets expected to move in lockstep, and drained about 15.5 million WFLOW from the reserve. That WFLOW was worth roughly $410,000, and slippage cut the realized take to about $246,000. Neither Flow EVM nor More Markets' own code was compromised. **Key lesson:** Forked code inherits forked assumptions. Efficiency mode is safe only while the correlated asset cannot be minted out of thin air, and a lending market's security boundary includes every collateral contract it accepts. The audit scope for a lending integration has to cover the tokens it lists, not only the market itself. --- ## The Long Tail August's smaller incidents cluster around the same themes as the large ones: bridges failing at deposit verification, thin-liquidity tokens, and repeat victims. | Protocol | Date | Loss | Exploit Type | Chain(s) | | --- | --- | --- | --- | --- | | MOKE Token | Aug 2 | $907K | Access control | BNB Chain | | CometDEX | Aug 25 | ~$718K | Contract logic | Stellar | | The Sandbox | Aug 21 | $675K | Contract logic | Base, BNB Chain | | RiseX | Aug 3 | $673K | Contract logic | Multi-chain | | LOOPSDAO | Aug 2 | $573K | Oracle manipulation | BNB Chain | | Avici | Aug 28 | ~$501K | Contract logic | Solana | | Coreum–XRPL Bridge | Aug 9 | ~199,900 XRP | Forged deposits; 17 of 28 relayer signatures | XRPL, Coreum | | Allbridge | Aug 19 | ~$190K | Bridge logic (repeat victim) | Multi-chain | | Enjin | Aug 25 | $162K | Contract logic | Multi-chain | | USM | Aug 10 | $136K | Contract logic | Ethereum | | FoxMarket | Aug 15 | ~$119K | Flash loan | BNB Chain | | warp.green | Aug 23 | $93K | Contract logic | Chia, Ethereum | Two deserve a note. The Coreum bridge attacker forged deposit transactions that the relayer set accepted as legitimate, gathering 17 of 28 required relay signatures across 94 multisignature transactions and draining the bridge from about 200,400 XRP to 493.5 XRP in 97 minutes. Deposit verification, not withdrawal authorization, was the failure, the same shape as July's Across relayer incident. And Allbridge was exploited again, after July's incident had already been its second. When the same protocol appears in consecutive recaps, the fix is not closing the exploited path. It is an independent review of the whole bug class. --- ## Attack Pattern Analysis: What August 2026 Tells Us | Attack Pattern | Notable Incidents | Approx. Losses | | --- | --- | --- | | Collateral and oracle manipulation on illiquid tokens | Tectonic, Moonwell, LOOPSDAO | ~$83M | | Keys, wallets, and signatures (including phishing) | Whale wallet, Coinsbuy, Fogo, Aquifer, RRWallet, Coldcard carryover | ~$42M plus Coldcard | | Chain-level and shared-module flaws | Cosmos EVM (six chains), BounceBit, Harmony, Injective | ~$17M realized, ~$26M gross | | Governance takeover | Term Finance | ~$8.5M | | Composed accounting and logic bugs | Maya, The Sandbox, CometDEX, RiseX | ~$4M | ### Pattern 1: Illiquid Collateral Was the Month More than half of every tracker's total came from a single technique: pump a thin token, post it as collateral, borrow real assets. Tectonic and Moonwell together accounted for about $83 million, and neither involved a broken oracle or a broken contract. The oracle reported the manipulated price faithfully. The contracts executed the borrows correctly. The parameters, a collateral factor and a debt ceiling with no relationship to executable liquidity, were the vulnerability. Parameter review belongs in audit scope. ### Pattern 2: The Bug Moved Below the Application Cosmos EVM, BounceBit, Harmony, and Injective were all flaws in chain modules or core settlement logic rather than in an application contract. Application teams inherited the risk without the ability to fix it. When the base layer is shared, one bug is a synchronized multi-chain incident, and disclosure timing becomes a security control in itself. Twenty hours between a public patch and the first attack, and about twelve between a public exploit description and the first attack, is the new baseline for how fast a silent fix gets weaponized. ### Pattern 3: Governance Keeps Getting Cheaper to Buy BonkDAO cost $4.4 million to attack in July. Term Finance cost about a thousand dollars in August. Both had the same root: a quorum measured against whoever showed up rather than against everyone with money at stake. Timelocks and vetoes existed at Term and did not help, because nobody was watching a vault with 0.535 governance tokens outstanding. ### Pattern 4: The User Layer Rivals the Protocol Layer The second largest loss of the month was one phished signature. Add Coinsbuy, Fogo, Aquifer, and RRWallet, and key and wallet compromise was the second largest category by dollars. None of it is fixed by a contract audit, all of it is fixed by operational security, and August is the second consecutive month in which it outweighed conventional code exploits. --- ## What Would Have Prevented These Attacks Every major August exploit maps to a known, preventable failure class. **For collateral manipulation (Tectonic, Moonwell, LOOPSDAO):** A per-collateral debt ceiling sized against executable on-chain liquidity and recomputed as that liquidity changes. A TWAP bound on accepted collateral prices with a maximum deviation from spot. A supply cap enforced on tracked principal rather than contract balance, so direct transfers cannot inflate collateral. A rule that low-liquidity governance tokens do not back borrowing at all. Real-time alerts on any collateral asset that moves more than a few multiples in an hour. [Audit your smart contracts with Cecuro →](https://app.cecuro.ai/auth?mode=signup) **For governance takeovers (Term Finance):** Quorum measured against total economic stake, not the subset that chose to wrap and vote, with an absolute vote floor. An explicit cost-of-attack calculation against the value the vote controls. Affirmative guardian approval for any proposal that moves funds, not only a veto during the timelock. **For chain-level flaws (Cosmos EVM, BounceBit, Harmony, Injective):** Checked arithmetic on every balance operation, with reconciliation between every layer that tracks a balance. Injective identifier and message encoding, fuzzed to prove no two inputs collide. Supply invariants monitored continuously. Private, severity-labeled advisories to operators before any patch is public, and no silent patches for bugs that touch balances. **For keys, wallets, and signatures (whale wallet, Coinsbuy, Fogo, Aquifer, RRWallet):** Transaction simulation and approval review for high-value signers. Hot-wallet balances capped at operational float, with the remainder behind hardware-backed multisig in independent environments. Audited entropy sources for any software that generates keys. Periodic re-review of cryptographic primitives, not one-time sign-off. **For composed logic bugs (Maya):** Invariant tests across state transitions, not only unit tests per function: reserves never credit more than they hold, failed transfers never leave state changed, and no message sequence moves a pool from solvent to empty. --- ## What This Means for Protocol Builders August 2026 makes the sharpest version of a point this series has been building toward all year. In the two largest protocol exploits, nothing was broken in the sense a linter or a unit test would recognize. The oracle was honest. The contracts executed as written. The parameters were wrong, and the parameters were never in anyone's audit scope. That is the shift. A collateral factor is code. A debt ceiling is code. A quorum denominator is code. A supply cap that checks contract balance instead of tracked principal is a vulnerability that reads like a design choice. Security review has to treat the economic configuration of a protocol as part of the attack surface, alongside the functions that enforce it, and it has to treat every shared module and every listed collateral token as inside the boundary. Modern protocol security works in three layers. **Layer 1: Pre-deployment auditing.** Comprehensive review covering code correctness, collateral and oracle parameters, liquidity-aware debt ceilings, governance quorum design and cost of attack, encoding injectivity for every identifier and signed message, and checked arithmetic across every balance boundary. This is where Tectonic's unbounded borrowing, Moonwell's cap bypass, Term's quorum denominator, and Injective's identifier collision should have been caught. **Layer 2: Continuous monitoring.** Real-time detection of anomalous activity: collateral assets moving multiples in minutes, borrows concentrated against a single thin token, native supply changing without a corresponding mint event, governance proposals that move funds. August's attackers worked in twenty-minute windows, so monitoring has to trigger automated caps and pauses, not only alerts. **Layer 3: Operational security.** Key rotation, hardware-backed signing in independent environments, transaction simulation for high-value signers, audited entropy for key generation, and private advisory channels for every shared dependency. This is the layer that produced August's second largest loss and most of its key-compromise incidents. Here is how Cecuro fits against the traditional model. | Dimension | Traditional Audit | Cecuro | | --- | --- | --- | | Turnaround | 2 to 6 weeks | Hours, typical | | Cost | $20K to $100K+ | Free trial, pricing starts at $799, about 90% less | | Coverage | Often single-chain focus | All chains and smart contract languages | | Technology | Manual, schedule-limited | AI-powered, multi-agent analysis | | Detection | Varies by reviewer | #1 on EVMBench | Cecuro's AI-powered platform analyzes smart contracts across all chains and languages in hours, not weeks. It offers a free trial, and pricing starts at $799, roughly 90 percent lower cost than traditional approaches, without trading away depth. Cecuro ranks first on EVMBench, the independent smart contract exploit benchmark. Our analysis threat-models the exact patterns that defined August 2026: collateral parameters against executable liquidity, supply cap enforcement, governance quorum design, encoding injectivity, and checked arithmetic across balance boundaries. [Start your free audit today →](https://app.cecuro.ai/auth?mode=signup) --- ## Looking Ahead: September 2026 August's record incident count is the number to watch, not its falling dollar total. More attackers succeeded than in any month this year, each taking less, which means the techniques are cheaper to execute and more widely understood. Three signals point to where September is heading. The illiquid-collateral playbook is now public, proven twice in one week, and cheap. Every lending market that lists a thin governance token with a non-trivial collateral factor and no liquidity-aware debt ceiling is carrying the same exposure Tectonic and Moonwell carried, and the window between a public exploit and a copycat is measured in days. Shared-framework risk is the second signal: Cosmos EVM showed that one silent patch can become a six-chain incident in under a day, and Evmos-descended chains still running discontinued code are a standing target. And governance keeps getting cheaper to capture, with the cost of attack at Term two orders of magnitude below BonkDAO a month earlier. The protocols that stay out of next month's recap will be the ones that treat parameters as code, dependencies as attack surface, and governance as a system with a purchase price that has to exceed what it controls. August 2026 cost the industry around $136 million and one chain's immutability. The lessons were cheaper to learn than to ignore. --- The Cecuro Security Team publishes monthly hack recaps to keep the community informed about emerging threats and prevention strategies. For real-time smart contract auditing and continuous protocol monitoring, visit [app.cecuro.ai](https://app.cecuro.ai).