Web3 Security Weekly News Review — August 17–23, 2026
This week's review covers August 17 – 23, 2026: 9 publicly reported events, ~$22.2M in realized losses. The headline is the Term Finance governance takeover on Ethereum — an attacker bought voting control of the ETH meta vault for roughly 0.5 ETH (and about $5 each across five USDC vaults) and drained ~$8.5M without touching a line of vulnerable code. The structural story is the Cosmos EVM balance-sync underflow, which one arithmetic bug spread across six chains.
Every item below was verified against the sources named on the card before publication. I count losses at realized value — what actually left each chain after halts, slippage and rollbacks — and say so when nominal figures are much larger. There were no confirmed TRON-linked incidents this week.
The Term Finance governance takeover: an attacker acquired a supermajority of six vaults' voting power for roughly 0.5 ETH in the ETH meta vault plus about $5 in each of five USDC vaults — governance participation was so thin that relative thresholds cleared with no absolute floor — then passed proposals that transferred ~$8.5M in WETH and USDC out of the vaults.
- Realized losses~$22.2M9 reported events
- Largest event~$8.5MTerm Finance governance
- Nominal vs realizedCosmos EVM~$67M+ nominal / ~$5.7M realized
- August pace~$255.4M46 incidents (DefiLlama)
Overview
Two stories define the week. First, Term Finance lost ~$8.5M to a governance takeover — the code did exactly what it was told, because the attacker was the governance. Second, the Cosmos EVM balance-sync underflow showed how shared infrastructure turns one bug into six incidents: the same 20-byte address could be a Cosmos vesting account and an EVM contract at once, and the EVM's spendable-balance sync subtracted delegated amounts it never owned, underflowing accounts to 2^256-1. The nominal damage (~$67M+ across Nesa, KiiChain, TAC and others) far exceeded the realized ~$5.7M, because slippage and chain responses contained most of it.
The week also delivered a user-side reminder: the Tornado Cash domain hijack (~$2.3M) hit people who typed an old URL, not people who signed anything. And two quieter stories previewed the month ahead: The Sandbox's bridge minted 14.9 billion unbacked SAND — an early, contained appearance of the unbacked-mint class — while BounceBit's $3.0M access-control breach and MAYAChain's six-defect chain (a crafted deposit corrupted outbound reconciliation, a recovery path inflated a low-liquidity pool, and the attacker walked the fake value out through liquidity operations) filled out a unusually diverse week.
The 9 Stories
Term Finance governance takeover (~$8.5M)
An attacker acquired a supermajority of a vault's governance voting power for roughly 0.5 ETH — almost no depositors had ever wrapped vault shares into the governance token, so the minimum-participation floor sat near zero. A malicious proposal revoked the vault's strategies and transferred its assets; six of Term's meta vaults were drained this way, for 2,841.74 WETH and 1.68M USDC in total. Term shut down its meta vaults afterward.
Source: BlockSec incident analysis; PeckShield estimate; CryptoSlate / Defimon coverage
Cosmos EVM balance-sync underflow, six chains (~$5.7M realized)
One arithmetic bug in shared infrastructure: when the EVM module synced spendable balances it subtracted the delegated amount from the existing balance, even though the delegation came out of the locked balance. Delegating 1 wei underflowed the EVM balance to 2^256-1; the attacker then crashed a staking module's account to zero and re-credited itself its balance — about 2.986 billion TAC (~$7.5M nominal) on TAC Chain alone. Nesa lost ~$50M nominal and KiiChain ~$9.7M; slippage and chain responses cut the realized take to ~$5.7M. A researcher reported the bug through the bounty program on April 25; Cosmos Labs silently patched it on Aug 19 with vague release notes, a downstream developer posted the exact exploit path on GitHub eight hours later, and the first attack landed about 20 hours after the patch.
Source: The Block; BlockSec; Quantstamp
Tornado Cash domain hijack (~$2.3M)
The tornado.cash domain reportedly expired — renewal had been disrupted by the 2022 OFAC sanctions — and community reporting says it was re-registered with a phishing front end. One reported victim lost 1,010 ETH (~$2.3M) within about 12 hours after reaching the site through an old bookmark; on-chain evidence independently confirms 810 ETH reaching an attacker-linked wallet, and the full 1,010 ETH figure has not been separately confirmed.
Source: PANews aggregation of on-chain reports; Wu Blockchain; crypto.news verification
MAYAChain accounting corruption (~$1.76M)
A single crafted deposit corrupted the cross-chain liquidity network's internal accounting so that valid withdrawals were treated as failed, triggering a recovery path that inflated a low-liquidity pool's recorded native-token balance with no real backing. The attacker drained the inflated value by adding and withdrawing liquidity. CACAO fell nearly 89% as the wider pool value repriced.
Source: BlockSec incident analysis; etherworld
BounceBit access-control exploit (~$3.0M)
BounceBit, a Bitcoin restaking Layer 1, was exploited through an improper access-control flaw for approximately $3.0M. The team moved to contain the exposure while investigations and remediation continued; the week's third-largest loss.
Source: The Crypto Times weekly review; DefiLlama hacks database
The Sandbox bridge unbacked SAND mint (~$675K realized; 14.9B face)
An attacker hijacked LayerZero delegate permissions through an approveAndCall function on The Sandbox's Base and BSC bridge setups, minting roughly 14.9 billion unbacked SAND (~$49B face value) without touching the Ethereum collateral. Only about 14.75M backed SAND (~$675K) plus ~79.7 ETH exited before bridging was disabled; SAND on Ethereum and Polygon was unaffected, and The Sandbox committed to 1:1 repayment of affected liquidity providers from treasury.
Source: Blockaid / PeckShield alerts; The Sandbox statements; NOMINIS monthly report
Allbridge bridge logic flaw (~$190K)
A logic flaw in the Allbridge cross-chain bridge was exploited for approximately $190K. SlowMist's post-mortem showed the attacker had been preparing since July 26 — calling Circle's MessageTransmitterV2 directly — before firing forged CCTP cross-chain messages on August 19. The bridge paused affected routes while the flaw was patched.
Source: NOMINIS monthly incident report; SlowMist post-mortem
warp.green smart-contract vulnerability (~$93K)
The warp.green cross-chain protocol was exploited for approximately $93K through a smart-contract vulnerability.
Source: NOMINIS monthly incident report
Arrakis V1 flash-loan price manipulation (~$7K)
An attacker used a flash loan to manipulate spot pricing against Arrakis V1 vaults, extracting approximately $7K.
Source: NOMINIS monthly incident report
Key Signals
| Signal | Reading |
|---|---|
| Realized loss trend | ~$22.2M this week; August tracking ~$255.4M across 46 incidents (DefiLlama) |
| Top vector | Governance design + shared infrastructure (Term Finance, Cosmos EVM) |
| Nominal vs realized | Cosmos EVM ~$67M+ nominal vs ~$5.7M realized — containment worked |
| Verification | 9 of 9 items confirmed |
| TRON activity | No confirmed TRON-linked incidents this week |
| Biggest watch item | Whether other Aragon-governed vaults disclose similar thin-electorate exposure |
TRON Footprint
No confirmed TRON-linked incidents this week: none of the nine events above involved TRON addresses, TRON-based assets or Tether blacklist actions in the window.
For Tron energy users, the week's transferable lesson is the Tornado Cash hijack: verifying the full receiving address is not enough if the site you typed it into is fake. Bookmark official URLs once and audit them periodically — and remember that energy costs for a routine transfer are trivial compared with one interaction on a hijacked front end.
What I'm Watching Next Week
- Term Finance's post-mortem and whether other protocols shipping per-vault Aragon DAOs disclose similar thin-electorate exposure.
- How the affected Cosmos EVM chains coordinate recovery, and whether Cosmos Labs publishes a proper advisory retroactively.
- Whether the Tornado Cash hijacker domain gets seized or sinkholed.
- August's month-end tally on DefiLlama — the week's realized pace (~$22.2M) sits well below the monthly $255.4M figure, so late-August events will decide the month's shape.
Sources
- BlockSec, 'Term Finance & MAYAChain' weekly incident report (week of 2026/08/17).
- Quantstamp, 'August 2026: The Price Feed Was Exploited' monthly review (DefiLlama-derived aggregates).
- The Block, Cosmos EVM incident coverage and Cosmos Labs response statements.
- NOMINIS, 'Crypto Exploits and Attacks in August 2026' monthly report (Sandbox, Allbridge, warp.green, Arrakis entries).
- PANews August security report and Wu Blockchain (Tornado Cash domain hijack figures); crypto.news on-chain verification.
- etherworld, 'August 2026 Among Worst Months for DeFi Hacks' (MAYAChain/CACAO detail).
- The Crypto Times weekly review and DefiLlama hacks database (BounceBit, Sandbox).
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Are the dollar figures exact?
No. All figures are estimates at the time of reporting, taken from the sources named on each card. I distinguish realized losses (what actually left a chain after halts, slippage and rollbacks) from nominal exposure, and label which is which.
Why is the Cosmos EVM event counted at ~$5.7M when headlines said $50M+?
The ~$50M figure was Nesa's nominal balance manipulated through the underflow. Slippage, burned transfers and chain responses cut the attacker's realized take across all six chains to roughly $5.7M. I count what the attacker actually extracted and note the nominal figures.
How does a governance takeover differ from a code exploit?
In a code exploit the attacker abuses a flaw in the contract logic. In the Term Finance takeover every contract worked as designed — the flaw was that the governance design let anyone cheaply acquire a majority of a nearly empty electorate and vote the vault's funds out. The fix is governance design, not a code patch.
What should users do about the Tornado Cash domain hijack?
Stop trusting typed or bookmarked URLs indefinitely. Verify official domains through a second channel, treat old bookmarks as untrusted until re-verified, and never enter a seed phrase on a site reached from an unverified link.
Were any TRON users affected this week?
No confirmed TRON-linked incidents were reported in the August 17–23 window. TRON activity is tracked and reported every week, including 'none confirmed' results.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.