BlockThreat - August, 2026

Four clear threat trends emerged this month that should concern anyone shipping code in this space: defenders leaking their own vulnerabilities, the return of "highly profitable trading strategies," and attackers moving past the low-hanging fruit to Bitcoin, non-EVM chains and other more esoteric targets. 62 incidents and $210M stolen in August is a preview of what is coming.

Complete breakdown of the manually researched Top 10 Attack Vectors, every major incident, and all four trends below.

BlockThreat Enterprise - org-specific threat intel, monthly private briefings, and tailored feeds for security teams. Learn more.

August 2026 Incident Statistics

Total Incidents: 62 (+24%)
Total Loss: $210,051,809 (-13%)
Average Loss per Incident: $3,387,932 (-30%)
Total Recovered: $73,640,000 (+903%)

Top 5 DeFi Incidents

1. Tectonic Compromise 2 (Price Oracle Manipulation) - $75,000,000
2. Steakhouse Financial Compromise (Price Oracle Manipulation) - $36,000,000
3. Kite AI Compromise (Stolen Private Keys) - $14,000,000
4. Moonwell Compromise 4 (Price Oracle Manipulation) - $8,730,000
5. Term Finance Compromise (Governance) - $8,500,000

Top 10 DeFi Attack Vectors

1. Price Oracle Manipulation - 9 (-44%) - $120,827,418 (+1815%)
2. Stolen Private Keys - 5 (-17%) - $29,045,760 (-4%)
3. Reward Manipulation - 10 (+233%) - $9,172,186 (+1511%)
4. Infinite Minting - 6 (New) - $13,717,000 (New)
5. Signature Verification - 8 (+33%) - $8,783,000 (-64%)
6. Governance - 3 (+50%) - $13,692,000 (-37%)
7. Consensus Failure - 3 (New) - $5,470,000 (New)
8. Function Parameter Injection - 2 (New) - $2,917,750 (New)
9. Function Parameter Validation - 1 (-67%) - $2,500,000 (+146%)
10. Insufficient Function Access Control - 2 (-33%) - $907,700 (+2105%)

Trends and Analysis

Trend 1: Coordinated Disclosure Failures

The most concerning security trend last month was not attackers finding novel bugs, but attackers weaponizing exploits based on vulnerabilities leaked by defenders themselves through overly verbose patches, onchain activity, and other publicly visible channels. The Cosmos ecosystem mass compromise is the case study to watch and avoid. At least six networks lost $12M after a critical vulnerability was quietly patched without coordinated disclosure, in the hope that no one would notice.

As we have discussed before, the economics of exploit development have changed significantly. Going from a patch, or even a high-level description of a vulnerability, to a fully functioning exploit is no longer measured in weeks or months, but in hours. The operating assumption should now be that any release of a binary, any PR, or even a mention of a vulnerability is a public disclosure event.

Trend 2: Highly Profitable Trading Strategies

The headline made famous by Avi Eisenberg after the $116M Mango Markets hack and a later unsuccessful AAVE/CRV attack caused a splash of concern back in 2022, then slowly faded from memory as we refocused on more traditional DeFi exploitation techniques. Four years later, in the middle of another bear market with thinned out liquidity, we are once again facing a rise in economic attacks draining millions.

Unlike their more conventional counterparts, economic attacks play a longer game and carry more risk for their perpetrators, but they can be just as devastating. Tectonic, Moonwell, and Steakhouse all experienced variations on the same playbook: build a large leveraged position, drive up or crash the price of a thinly traded asset, then profit through inflated collateral, forced liquidations, or a similar mechanism. The lesson is that these are complex attacks and three of them stealing ~$120M in a single month is a trend worth watching and defending against.

Trend 3: Bitcoin Projects are Under Attack

Bitcoin infrastructure has not faced the onslaught that EVM, Solana, and other smart contract chains have been fighting off for the past year. That changed with the $116M Coldcard exploit at the end of July. From wallet developers like Zeus to payment providers like BTCPay, every layer of Bitcoin infra is now a target. The Liquid Network compromise in September was not an isolated event but a result of a systematic review of an ecosystem that went untested for too long.

If you are an exchange operator, build a wallet, operate a DeFi protocol, or maintain a sidechain, treat this as your red flag. Attackers are actively hunting for vulnerabilities that affect you, and their tooling has advanced to the point where an unfamiliar or complex codebase is no longer the barrier it used to be.

Trend 4: Blockchains are Targeted

Attackers have moved beyond popular ecosystems and beyond high-level DeFi protocols to target blockchain consensus and reward logic itself. There were 11 blockchain related incidents this month, most of them resulting in infinite minting or consensus failure. The target profile has changed too, from a handful of popular chains to far more obscure ones: a consensus failure in the little-used Ravencoin, infinite minting in Aventus, reward manipulation in Injective, the mass compromise across Cosmos chains, and more.

If you operate a blockchain, particularly a smaller one where you have assumed no one would bother, it is time to challenge that assumption. Attackers can now scale their efforts like never before, at almost no cost.

Future Outlook

The four trends above are the same trend viewed from different perspectives. Attackers have worked through the easy inventory and are moving up the difficulty curve into the lower layers of consensus logic, economic assumptions, and esoteric codebases. Protocols that have relied on security through obscurity are about to have that assumption brutally challenged.

This is made harsher by the offense-defense asymmetry we are living through. Egged on by the AI companies themselves, the majority of research and development effort is going into offensive capability, with nothing comparable to show on the defensive side.

Bring BlockThreat Inside Your Security Program
See the threats that matter to your stack before they become your incident.

BlockThreat Enterprise gives security teams organization-specific threat intelligence reports, monthly briefings, priority access to research, and optional tailored feeds drawn from the exploits, threat actors, techniques, and trends I track daily across Web3.

Trusted by teams behind major L1s, DeFi protocols, staking infrastructure, wallets, and security organizations responsible for billions of dollars in assets.

Enterprise includes direct engagement and tailored reporting, so I can only support a small number of teams at a time.

Inquire