Web3 Security Weekly News Review — August 24–30, 2026
This week's review covers August 24 – 30, 2026: 10 publicly reported events, ~$33.8M in realized losses. The week — and with it the month — belongs to collateral-price manipulation: an attacker pumped Tectonic's thinly traded TONIC ~100x and borrowed $120.4M across nine markets before Cronos halted and rolled back the chain, and Moonwell on Base lost ~$8.7M to the same play on the MAMO token.
I count losses at realized value: Tectonic's realized out-of-chain loss was ~$9.2M because the rollback reversed $111.2M of the borrowed amount. Every item below is verified against the sources named on the card; no confirmed TRON-linked incidents appeared in the window.
The Tectonic exploit on Cronos: an attacker pumped the thinly traded TONIC token ~100x in about 20 minutes, posted it as collateral and borrowed $120.4M across nine markets. Cronos halted block production about two hours in — by which point ~$9.19M had left the chain — and validators rolled back 10,961 blocks, reversing the remaining $111.2M.
- Realized losses~$33.8M10 reported events
- Largest event$120.4Mborrowed via TONIC pump; ~$9.2M realized
- Rollback10,961 blocks$111.2M reversed on Cronos
- Month context~$255.4MAugust, 46 incidents (DefiLlama)
Overview
August closed at ~$255.4M across 46 incidents — level with July's ~$254.4M, but with more incidents than any month this year, and a decisive shift in method: eleven oracle and price-manipulation events carried 53% of the month (Quantstamp, DefiLlama-derived). This week supplied the month's two defining events. Tectonic's $120.4M borrowed figure alone is nearly half the monthly total on nominal terms; on realized terms the rollback cut it to ~$9.2M. Moonwell's MAMO drain — a roughly 40x price move against a thin pool, $11.03M borrowed gross across four markets — was the same play at the scale that actually cashes out: ~$8.7M.
The week's counter-signals: Realio Network's signing-key leak (~$6.2M across five chains) kept credential compromise on the board, and the GOLD token rug pull (~$8.2M) was a reminder that not every large loss needs a technically skilled attacker. Two chains have now used consensus-level rollbacks as incident response in a single month — Cosmos-side halts last week, Cronos this week — which changes what finality means for application teams.
The 10 Stories
Tectonic TONIC pump-and-borrow ($120.4M borrowed; ~$9.2M realized)
An attacker pumped TONIC — Tectonic's thinly traded governance token with roughly $305K in weekly volume — about 100x in roughly 20 minutes, then posted the inflated position as collateral on Cronos' largest lending protocol and borrowed $120.4M across nine markets. Cronos halted block production about two hours in; by then $9.19M had left the chain, and validators rolled back 10,961 blocks to reverse the remaining $111.2M. Tectonic warned users off the protocol while safety was verified; its TVL collapsed to ~$3M.
Source: TRM Labs; CoinDesk; Quantstamp; SlowMist (accounts of the borrowed total differ; realized figure used here)
Moonwell MAMO oracle-price manipulation (~$8.7M)
An attacker moved MAMO — a token with extremely thin liquidity — from ~$0.0106 to a peak of ~$0.4313 (roughly 40x; Moonwell's oracle accepted prices up to ~$0.40), then borrowed a gross $11.03M across the cbBTC, WETH, USDC and wstETH markets. About $8.7M was consolidated on Ethereum and converted to DAI; Moonwell's day-two accounting put the market's bad debt at ~$9.13M. Moonwell capped Base borrows afterward. It was the protocol's third oracle-related failure since November 2025, after the wrsETH feed and the cbETH mispricing.
Source: BlockSec; Quantstamp
GOLD token rug pull (~$8.2M)
A group controlling the website and social accounts of the GOLD token issued the token, sold its holdings into the market and abandoned the project, extracting approximately $8.2M. The token fell roughly 99%.
Source: PANews August security report
Realio Network signing-key leak (~$6.2M)
A signing-key compromise on Realio Network led to unauthorized transactions across five chains, with losses of approximately $6.2M.
Source: PANews August security report
Avici Solana card contract drained ($500.9K)
Attackers exploited an outdated version of Rain's Solana card contract used by Avici, submitting crafted signature bundles to gain unauthorized admin rights via AddCollateralAdmin and withdrawing collateral — $500,859 from 1,685 users' card balances. Self-custodial wallets were unaffected; the contract was upgraded across all programs and full refunds were promised.
Source: SlowMist; Avici statements
CometDEX smart-contract vulnerability (~$717.5K)
CometDEX was exploited for approximately $717.5K through a smart-contract vulnerability.
Source: NOMINIS monthly incident report
Enjin smart-contract vulnerability (~$162K)
A smart-contract vulnerability in Enjin's ecosystem contracts was exploited for approximately $162K.
Source: NOMINIS monthly incident report
Full Sail oracle key manipulation (~$91K)
An attacker exploited a vulnerability in Switchboard's production code to add a controlled key to a live oracle, published false prices roughly 100x below market, deposited into Full Sail vaults at the distorted values, then restored prices and withdrew more than deposited — approximately $91K.
Source: SlowMist
FH Token exploit (~$20K)
A smart-contract vulnerability in FH Token was exploited for approximately $20K.
Source: NOMINIS monthly incident report
Trezor fulfilment partner breach — 13,689 customers' data
Trezor disclosed (August 13) that its fulfilment partner ShipMonk suffered a breach exposing personal information of 13,689 customers — 11,742 with full exposure and 1,947 partial. No seed phrases or funds were reported affected. On September 2 Trezor said the same breach also exposed order data from its 2019–2021 relationship with ShipMonk, affecting roughly 67,000 additional US customers.
Source: Trezor disclosure; etherworld
Key Signals
| Signal | Reading |
|---|---|
| Realized loss trend | ~$33.8M; August closes ~$255.4M across 46 incidents (DefiLlama) |
| Top vector | Oracle / collateral-price manipulation — 53% of August's losses |
| Containment | Cronos rollback reversed $111.2M; realized kept to ~$9.2M |
| Verification | 10 of 10 items confirmed (1 informational, no loss figure) |
| TRON activity | No confirmed TRON-linked incidents this week |
| Biggest watch item | Whether thin-collateral lending markets reprice collateral factors and supply caps |
TRON Footprint
No confirmed TRON-linked incidents this week: the Tectonic episode is Cronos-native, Moonwell is Base-native, and Realio's five affected chains were not itemized publicly. TRON-related freezes and blacklist actions are tracked weekly and will be reported when they occur.
For Tron energy users the week's transferable lesson is the rug pull: no technical control protects you from the team controlling the token. Liquidity locks, vesting schedules and verified custody of the mint authority are the whole defense — and the energy cost of checking them is zero.
What I'm Watching Next Week
- Tectonic's post-mortem: how the borrowed assets are treated on-chain and whether the stranded balance becomes recoverable.
- Whether Moonwell's Base borrow caps hold under re-testing, given three oracle-related failures since November 2025.
- Avici's refund execution across 1,685 affected users.
- September's opening week — the last two months closed at ~$254M each, and the largest events have clustered late.
Sources
- Quantstamp, 'August 2026: The Price Feed Was Exploited' (DefiLlama-derived aggregates; Tectonic and Moonwell detail).
- TRM Labs and CoinDesk, Tectonic incident coverage.
- SlowMist Hacked database (Avici, Full Sail entries).
- NOMINIS monthly report, August 2026 (CometDEX, Enjin, FH Token).
- PANews August security report (GOLD rug, Realio key leak).
- Trezor / ShipMonk disclosure, August 2026.
This article is for general information only. It describes publicly reported security incidents; dollar figures are point-in-time estimates drawn from the sources listed above and may be revised as investigations continue. Nothing here is financial, legal or investment advice.
Frequently Asked Questions
Why do you report Tectonic as ~$9.2M when other outlets say $75M–$120M?
$120.4M is what was borrowed against the manipulated collateral. Cronos halted and rolled back 10,961 blocks, reversing $111.2M; ~$9.19M had already left the chain. I report the realized figure and note the nominal one. SlowMist's $75M accounting sits between the two and is acknowledged where relevant.
Are these figures exact?
No. They are point-in-time estimates from the sources named on each card, and they may revise as post-mortems land. The event count and share arithmetic are computed exactly from the list.
What does a chain rollback mean for users?
Transactions in the rolled-back blocks — including the attacker's — are reversed. It is the strongest containment tool that exists, and the fact that two chains used it within one month means application teams on those chains cannot treat confirmed blocks as immutable during an incident.
Were any TRON users affected this week?
No confirmed TRON-linked incidents were reported in the August 24–30 window. TRON activity is tracked every week, including 'none confirmed' results.
Strengthening your defenses? See how transaction fees and energy costs scale on Tron at Tronsell.io.