Web3 Security Weekly Intelligence — August 17–23, 2026

Q1 — Wallets: What happened to wallets this week?

The user-side loss of the week did not involve a signature, an approval or a seed leak — it involved a URL. The Tornado Cash domain reportedly expired, was re-registered, and cost one reported victim ~$2.3M (1,010 ETH) within about 12 hours, with 810 ETH independently confirmed on-chain. The wallet layer held everywhere else: no wallet vendor, browser extension or clipboard-hijacker campaign appears in the week's reported set. The lesson is infrastructural: your attack surface includes every URL you've ever bookmarked, and bookmarks do not expire the way domains do.

Q2 — Smart Contracts: What happened at the contract layer?

The contract layer's biggest loss of the week involved no vulnerable contract. Term Finance's six vaults were drained through their own governance: relative support and participation thresholds with no absolute floor, an electorate that had never met, and an execution delay with no guardian. The Sandbox (~$675K), warp.green (~$93K) and Arrakis V1 (~$7K) were conventional contract exploits — small, and in Arrakis's case a familiar flash-loan spot-price pattern. Read together: the novel risk this week was configuration and governance, not bytecode.

Q3 — DeFi & Bridges: What happened across DeFi and cross-chain?

Cross-chain infrastructure carried the week's structural story. The Cosmos EVM balance-sync underflow turned one arithmetic bug into six chain-level incidents (Nesa, KiiChain, TAC, MANTRA and others, August 20–25) — ~$67M+ nominal exposure compressed to ~$5.7M realized by slippage and fast chain responses. MAYAChain's ~$1.76M loss was the same theme in miniature: six chained accounting defects, each survivable alone, composed into a drain through a recovery path. Allbridge (~$190K) and warp.green (~$93K) round out the bridge tally. The pattern: cross-chain systems fail through composition — the interaction of paths, not any single path.

Q4 — People & OpSec: What does the week say about people and process?

The Cosmos EVM disclosure timeline is the week's process failure. A researcher reported the bug on April 25; Cosmos Labs' testers concluded live networks were not vulnerable; the patch shipped silently on August 19 with vague release notes; a downstream developer posted the exact exploit path on GitHub eight hours later; the first attack landed about 20 hours after the patch. Every element of that chain is a decision, and each one bought the attacker time. Separately, Term Finance's empty electorate is a people failure: nobody ever wrapped their vault shares to vote, so nobody was there to vote no.

Q5 — Outlook: What should you watch next week?

Three watch items. First, whether other protocols that ship per-vault DAOs (the Term Finance pattern) audit their governance electorates — the vulnerability class is discoverable from public chain data before an attacker finds it. Second, how the affected Cosmos EVM chains coordinate recovery and whether Cosmos Labs publishes a vulnerability-specific advisory retroactively. Third, the August month-end tally: this week's realized pace (~$22.2M) sits below the month's eventual ~$255.4M, so the final week of August decides the month's shape — and late-month weekends have historically carried the largest events.