Web3 Security Weekly Data Report — August 24–30, 2026
This report computes the week's indicators from the ten publicly reported items in the matching news review — nine loss events plus the Trezor data breach, which carried no on-chain loss and is excluded from loss sums. Same shared dataset, same window, realized-loss basis. Where a containment action (the Cronos rollback) materially changed the outcome, both nominal and realized figures are shown.
Approximately $33.8M in realized losses across 9 loss events (10 reported items including the Trezor data breach, which carried no on-chain loss) — up ~52% from the prior week's ~$22.2M. The nominal picture was far larger: Tectonic alone borrowed $120.4M before the Cronos rollback reversed $111.2M.
- Realized losses~$33.8M+52% w/w
- Loss events9plus 1 data breach (Trezor), no on-chain loss
- Largest realized event~$9.2MTectonic, after the $111.2M rollback
- Nominal exposure$120.4MTectonic borrowed, $111.2M reversed
The Week in Numbers
| Indicator | Reading | Basis |
|---|---|---|
| Realized losses | ~$33.8M | +52% vs prior week's ~$22.2M |
| Loss events | 9 | plus 1 data breach (Trezor), excluded from loss sums |
| Largest realized event | ~$9.2M | Tectonic, after the $111.2M rollback |
| Largest nominal event | $120.4M | Tectonic borrowed; Moonwell ~$8.7M second on realized basis |
| Top-3 concentration | ~77% | Tectonic $9.2M + Moonwell $8.7M + GOLD $8.2M |
| Median event size | ~$717.5K | CometDEX sits mid-list of the nine loss events |
Where the Losses Sat
| Failure vector | Realized loss | Share | Events |
|---|---|---|---|
| Oracle / price manipulation | ~$18.0M | 53% | 3 (Tectonic, Moonwell, Full Sail) |
| Scam / rug pull | ~$8.2M | 24% | 1 (GOLD) |
| Key compromise | ~$6.2M | 18% | 1 (Realio, five chains) |
| Protocol exploits | ~$1.4M | 4% | 4 (Avici, CometDEX, Enjin, FH) |
What the Numbers Say
Three observations. First, method shift confirmed: price and oracle manipulation carried 53% of the week and 53% of the month — August is the month the attack mix rotated away from key theft, and this week is where it shows up in dollar terms. Second, the nominal-versus-realized spread is the widest on record for a single week here: $120.4M borrowed against ~$9.2M realized, because consensus-level containment worked. A weekly total that only counted nominal figures would have shown ~$145M and missed the actual story. Third, concentration held at ~77% — and the composition changed entirely: Tectonic, Moonwell and GOLD replaced Term Finance, Cosmos EVM and BounceBit in the top three, while the week remained top-heavy.
Month Context
August closed at ~$255.4M across 46 incidents, essentially level with July's ~$254.4M but with the highest incident count of the year (DefiLlama, via Quantstamp). Category-level for the month: oracle/price manipulation ~$135.87M (11 incidents, 53%), token and share accounting ~$61.20M (6), private-key and hot-wallet compromise ~$18.34M (4), access-control takeover ~$16.15M (9), protocol logic ~$10.61M (7), malicious governance proposals ~$8.51M (2), bridge signature/verification bypass ~$4.68M (5).
Method Note
Figures are point-in-time estimates from the sources named in the matching news review; the event count and all share arithmetic are computed exactly from that list. Where public accounts diverge (SlowMist's $75M for Tectonic versus the $120.4M-borrowed/$9.2M-realized split), the divergence is stated rather than averaged.
Sources
- Quantstamp monthly review, 'August 2026: The Price Feed Was Exploited' (DefiLlama-derived).
- TRM Labs and CoinDesk, Tectonic coverage.
- BlockSec, Moonwell exploitation analysis.
- SlowMist Hacked database (Avici, Full Sail).
- NOMINIS monthly report, August 2026.
- PANews August security report (GOLD, Realio).
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Which numbers are estimates?
All dollar figures are point-in-time estimates from public reporting and may revise. The loss-event count (9, plus the Trezor data breach tracked separately), category splits and concentration arithmetic are computed exactly from the shared incident list.
Why is the largest realized event Tectonic and not Moonwell?
Because the Cronos rollback reversed $111.2M of Tectonic's borrowed $120.4M, its realized loss is ~$9.2M — still ahead of Moonwell's ~$8.7M. The two are within ~$0.5M of each other, and both are listed with their basis.
What changed in the attack mix this month?
June and July's losses were dominated by key compromises; August rotated to price and collateral manipulation (53% of monthly losses). This week's Tectonic and Moonwell events are the two largest data points in that shift.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.