Wallet Safety Intelligence — Week of August 17–23, 2026

This is our structured weekly briefing, answering five fixed questions so weeks can be compared and a picture can build over time. Each answer is limited to 1–2 paragraphs, stays inside the cited sources, and separates confirmed facts from judgment.

This edition covers the week of August 17–23, 2026.

1. Threats: What Is the Overall Wallet Threat Posture This Week?

Two parallel threat tracks defined the week. At the protocol layer, BlockSec recorded two major incidents in the Aug 17–23 window — Maya Protocol (~$1.76M direct, up to ~$11M pool damage) and Term Finance (~$8.5M) — for roughly $10.3M in combined losses, with the Term case notable because it was a governance design failure, not a code bug: near-zero voting participation let an attacker take a vault's governance with about 0.5 ETH. At the user layer, the week's dominant mechanisms were unchanged from the month's pattern: address poisoning running at industrial scale (Trust Wallet reports 225M+ detected attempts industry-wide), approval phishing delivered through search ads, and support impersonation tied to a $300M+ Coinbase campaign.

The month-level frame matters for reading the week: DefiLlama logged 17 incidents and ~$18.8M in August before the Term drain — well below July's 38 incidents and ~$254M, which included the $116M Coldcard firmware-flaw class. In other words: this was a comparatively quiet week for raw losses, but every dominant threat class was active, and each user-side loss required only one signature or one pasted address.

2. Losses: What Were the Realized Losses and the Typical Cases?

Confirmed protocol losses in the window totaled roughly $10.3M across two incidents (per BlockSec's weekly analysis): Term Finance ~$8.5M (2,843 ETH + 1.68M USDC) and Maya Protocol ~$1.7M direct (~20.83 BTC). User-side losses inside the window were led by the ~$2M Bofur Capital address-poisoning case (Aug 22). The largest context number remains H1 2026: $1.1B lost across 212 incidents per Blockaid, of which ~$790M involved private-key compromise.

The typical case this week was not a whale and not a protocol: it was an experienced operator copying an address from history (Bofur) or connecting a wallet to a site reached through a search ad (Hyperliquid case). Losses concentrate where friction is lowest — exactly the steps users perform from memory.

3. Scams: What New Mechanics Appeared, and How Do You Recognize Them?

The week's clearest user-side mechanics came from the Bofur case: a dust transfer from a vanity-matched address, planted roughly 20 hours before the real payment — industrial-scale poisoning executed at near-zero cost. Support impersonation also stayed active (the $300M+ Coinbase campaign moved funds on Aug 17), and Australia's regulator reported deepfake-driven celebrity scams driving multi-million-dollar losses. Separately, address poisoning continued its industrial pattern on TRON: dust from vanity-matched addresses, mechanical swapping of proceeds and consolidation into single wallets — a pattern investigators have documented across recent campaigns.

• Recognition — search-ad phishing: a sponsored result above the real link for a DeFi platform. The cloned site is near-identical; the approval it requests is the theft. Defense: bookmarks only.
• Recognition — address poisoning: a tiny incoming transfer (0.0002 USDC-class) from an address sharing the first/last characters of someone you have paid. Defense: address book entries and full-string verification.
• Recognition — support impersonation: an inbound call/DM about account 'security' asking for codes, remote access, or a transfer. Defense: hang up, re-enter via the official app.
• Recognition — governance capture (for depositors): a vault whose governance token almost nobody holds. Defense: check participation and timelocks before depositing.

4. Operations: What Should Ordinary Users Actually Do This Week?

Five concrete actions, ordered by value: (1) audit and revoke stale token approvals — our Weekly Operation Guide walks the full TRON routine; (2) stop copying recipient addresses from transaction history; save payees in the wallet address book and verify full strings, especially on TRON where wallet-level poisoning protection is still thin; (3) replace search-engine navigation with bookmarks for every financial platform you use; (4) run a small test transfer before any large send; (5) if you deposit into governed vaults, spend five minutes checking governance participation and whether admin actions sit behind a timelock — the Term case shows that check is not theoretical.

None of these steps costs money, and none requires new tooling. They are repetitions, not upgrades — which is precisely why they work against industrialized scams that depend on habit.

5. Outlook: What Deserves Attention in the Week Ahead?

Watch items: (1) whether TRON wallet vendors announce poisoning-interception measures — in-window cases like Bofur Capital put vendor response in focus, and a shipping patch would materially change the TRON risk profile; (2) poisoning-campaign follow-ups on TRON — whether investigators publish quantified tallies for the campaigns active in this window; (3) the aftermath of the Term Finance and Maya incidents — whether recovery, restart or compensation plans emerge, which will inform how depositors should weigh governance and bridge risk; (4) month-end loss data: whether August closes near ~$27M+ or further incidents push it toward July's scale.

These are watch items, not predictions: we flag what could move wallet risk and why, and we will check next week which of them materialized.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.