Web3 Security Weekly Data Report — August 17–23, 2026
This report computes the week's indicators from the nine publicly reported events in the matching news review — same shared dataset, same window. Figures are point-in-time estimates from public reporting; nominal exposure is shown separately from realized losses where they diverge materially.
Approximately $22.2M in realized losses across 9 publicly reported events. Realized value counts what actually left each chain; the Cosmos EVM underflow alone carried ~$67M+ in nominal exposure but only ~$5.7M realized after slippage and chain responses.
- Realized losses~$22.2M9 reported events
- Largest event~$8.5MTerm Finance
- Top-3 concentration~77%of the weekly total
- Confirmed rate9 / 9all items confirmed
The Week in Numbers
| Indicator | Reading | Basis |
|---|---|---|
| Realized losses | ~$22.2M | Sum of the 9 confirmed events below |
| Reported events | 9 | All confirmed against named sources |
| Largest event | ~$8.5M | Term Finance governance takeover (Aug 23) |
| Top-3 concentration | ~77% | Term $8.5M + Cosmos EVM $5.7M + BounceBit $3.0M |
| Median event size | ~$1.8M | MAYAChain sits at the middle of the nine-event list |
| Nominal exposure (excl.) | ~$67M+ | Cosmos EVM across six chains, before containment |
Where the Losses Sat
| Failure vector | Realized loss | Share | Events |
|---|---|---|---|
| Governance takeover | ~$8.5M | 38% | 1 |
| Shared infrastructure (Cosmos EVM) | ~$5.7M | 26% | 1 (six chains) |
| Access control (L1) | ~$3.0M | 14% | 1 (BounceBit) |
| Phishing (domain hijack) | ~$2.3M | 10% | 1 |
| Bridge / cross-chain accounting | ~$2.0M | 9% | 3 (MAYAChain, Allbridge, warp.green) |
| Protocol exploits (unbacked mint & flash loan) | ~$0.7M | 3% | 2 (Sandbox, Arrakis) |
What the Numbers Say
Three observations, computed from the table above. First, concentration: the top three events carry ~77% of the week — an $8.5M governance takeover, one shared-infrastructure bug and one access-control breach put a small floor under the week's dispersion. Second, the shape is unusual: no classic private-key or hot-wallet compromise appears in the window, and the largest loss came from a governance design flaw rather than a code bug. Third, the nominal-versus-realized gap matters: the Cosmos EVM event would have made this a ~$84M week on nominal figures, but slippage and chain responses held realized losses to ~$5.7M — containment is now a measurable part of the loss picture.
Month Context
July 2026 closed at ~$254.4M (DefiLlama, via Quantstamp's monthly review); August closed at ~$255.4M across 46 incidents — the most incidents of any month this year, with oracle and price-manipulation events carrying 53% of the month. This week's realized ~$22.2M runs well below that monthly pace; the month's shape was decided by events outside this window, notably the month-end Tectonic episode covered in next week's report.
Method Note
Every figure here is computed from the incident list in the matching news review and traceable to the sources named there. Figures are estimates at time of reporting and may revise as investigations close; where an aggregator's number differs (for example SlowMist's $75M accounting for the Tectonic event in the following week), the divergence is stated rather than averaged.
Sources
- BlockSec weekly incident report, week of 2026/08/17.
- Quantstamp monthly review, 'August 2026: The Price Feed Was Exploited' (DefiLlama-derived).
- The Block, Cosmos EVM coverage.
- NOMINIS monthly report, August 2026.
- PANews August 2026 security report.
- The Crypto Times weekly review; DefiLlama hacks database (BounceBit).
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Which numbers are estimates?
All dollar figures are estimates at time of reporting, derived from public incident reporting. The event count (9) and the share arithmetic over the list are computed exactly from that list; the loss figures themselves may revise as post-mortems land.
What does 'realized' mean here?
Funds the attacker actually extracted and kept out of the chain, after halts, slippage, rollbacks and burn effects. Nominal exposure — balances manipulated or put at risk — is shown separately where it diverges materially.
Why is there no month-over-month comparison?
The weekly view is the default. Month-level context (July ~$254.4M, August ~$255.4M per DefiLlama) is given as context, but weekly reports compare week-over-week only, on a consistent realized-loss basis.
How is top-3 concentration computed?
The three largest events' realized losses divided by the weekly realized total: ($8.5M + $5.7M + $3.0M) / $22.2M ≈ 77%.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.