August’s worst crypto loss did not involve a smart contract

A month of frequent attacks and modest DeFi damage

The fixed-rate lending market term finance lost about $8.5m on Sunday, 23 August. Blockchain security firms reported that an unknown attacker used the protocol’s governance system to move ether and stablecoins out of its vaults.

Term Labs is a repeat entry. DefiLlama already logged a $1.65m loss at Term Finance in April 2025, which the team attributed at the time to a misconfigured price feed.

Governance attacks remain rare and expensive. DefiLlama classifies five 2026 incidents worth a combined $25.1m in that category, led by a $20m malicious proposal against BonkDAO in July.

The Coinsbuy attack needed no code bug at all

On 9 August, payments processor and venue Coinsbuy lost more than $8m. The attack hit wallets on TRON and Ethereum almost simultaneously and wrapped up in under an hour.

Investigating researchers found neither a smart contract flaw nor a phishing email behind it. The groundwork was a five-cent test transaction and a cross-chain route that let the attacker cash out before anyone could respond.

Investigators identified the Bridgers service as the link between the TRON and Ethereum withdrawals. Roughly $6.3m to $6.4m subsequently moved through FixedFloat, according to intelligence firm BlockWatchdog.

Four more incidents and one rolled-back chain

The month brought an unusual cluster of smaller cases. Allbridge lost 191,156 USDC on Base on 19 August after a newly deployed router credited a forged Circle message as genuine.

On 18 August, a chained subsidy exploit hit Maya Protocol on MAYAChain. At Harmony, an attacker minted roughly 4 billion ONE without authorisation, while Sandbox disclosed a vulnerability in its SAND bridge.

Ravencoin rolled its chain back across three days. None of these reached the $13.4m threshold required to enter the list of the ten largest DeFi attacks of 2026.

The exception was not a DeFi protocol at all

One August incident dwarfed everything above, and it never touched a smart contract. A firmware exploit against Coldcard hardware wallets cost holders 1,816 BTC, roughly $116m, which TRM Labs ranks as the third-largest crypto theft of 2026 and enough to push the year past $1.2bn across 276 incidents.

Its aftermath was unusual. Stolen funds pooled at a handful of attacker addresses with almost no layering or mixing, a pattern that looks nothing like the rapid laundering typical of state-linked groups, and one on-chain message even offered to launder the coins for a 7 percent fee.

The practical warning matters more than the ranking. Updating firmware does not repair an already generated key, so anyone who created a seed on a Coldcard between March 2021 and the patch should treat it as compromised and migrate.

The year underneath is one of the worst on record

Context has made August a much worse month. Security firm SlowMist counted 182 incidents worth about $956m in the first half of 2026, while TRM Labs logged 207 incidents and $972m.

DefiLlama recorded 99 separate attacks in the second quarter alone, the highest quarterly count in its database. July losses came to roughly $247.4m.

Immunefi puts DeFi-specific losses for the first half at about $680.3m, down 74 percent from the 2022 peak. The two readings do not contradict each other, since attacks are getting cheaper and more numerous while the median loss per incident falls.

An analysis by Koinly makes the shift explicit. Compromised accounts now make up more than half of all DeFi attacks by incident count, overtaking classic smart contract exploits as the leading cause for the first time.

The year’s biggest cases support that reading. Both the $292m loss at KelpDAO and the $285m at Drift Protocol traced back to compromised infrastructure and stolen keys rather than broken code.

Sources

• The Block, 23 August 2026
• TRM Labs on the Coldcard exploit, August 2026
• io, August 2026
• Defimon top-ten list, August 2026
• SlowMist H1 2026 report
• Immunefi H1 2026 report