This is our weekly review of wallet security: the incidents that cost users money over the past seven days, what actually happened in each case, and the one operation habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers August 17–23, 2026.
1. The Week at a Glance
~$10.3M
Protocol losses from 2 major incidents (BlockSec)
Maya Protocol + Term Finance, Aug 17–23
$8.5M
Largest single incident: Term Finance
governance capture, Aug 23
~$2M
Largest user-side poisoning loss
Bofur Capital, Aug 22
$300M+
Coinbase impersonation campaign total
actor moved funds Aug 17
The week splits cleanly into two threat classes. Protocol-level exploits — Term Finance and Maya Protocol — took roughly $10.3M in direct losses, and both were failures of design and process rather than of wallet operation. User-facing theft continued along the year's dominant rails: address poisoning, approval phishing delivered through search ads, and support impersonation. None of the user-side losses required a blockchain vulnerability; each required exactly one user mistake.
Key takeaways
Governance was the week's biggest single point of failure: near-zero participation let a small attacker control a treasury.
Address poisoning is now a repeatable industrial process on TRON and EVM chains alike — the Bofur case shows a $2M loss needs nothing more than one copied address.
Bridge halts are availability risk: Maya users could not move funds during incident response — treat bridge balances as transient.
Every user-side loss this week traces back to one signature or one copied address — the losses were operationally preventable.
2. Incident Review
#1Aug 23DefiImpact High
Term Finance loses ~$8.5M to a governance capture that cost the attacker ~0.5 ETH
Summary. The attacker took control of on-chain vault governance on Term Finance (fixed-rate lending on Ethereum) because almost no depositors had minted the vaults' governance tokens. With about 0.5 ETH the attacker reached an absolute voting majority, passed the protocol's support-threshold and quorum checks, executed a malicious proposal that revoked the vault strategy, and drained roughly 2,843 ETH and 1.68M USDC (~$8.5M) from six vaults. PeckShield tracked the outflows; the attacker's wallet had been seeded with 2 ETH withdrawn from Tornado Cash.
Commentary. The wallet-safety lesson is indirect but important: your deposits are exposed to more than your own keys. Governance participation and timelock design are part of the risk surface of every vault you sign an approval into. Before depositing, check whether the protocol's admin functions sit behind a timelock and whether governance actually has participants.
Maya Protocol exploited via chained logic bugs; ~20.8 BTC out, network halted until Aug 21
Summary. Attackers chained multiple accounting and state-verification flaws in a single transaction on the Maya cross-chain liquidity protocol, inflating the recorded balance of a low-liquidity pool without real backing. Direct losses were approximately 20.83 BTC (~$1.7M), with broader pool damage estimated up to ~$11M. The CACAO token fell about 89% within hours and the network remained halted until August 21.
Commentary. Cross-chain bridges concentrate user funds precisely because they are operationally convenient. When a bridge halts, users cannot move funds — an often-overlooked availability risk. Keep balances on bridges transient, not as storage.
Bofur Capital loses ~$2M to address poisoning: a 0.0002 USDC dust transfer set the trap 20 hours earlier
Summary. Investment firm Bofur Capital withdrew funds from Compound and pasted a recipient address copied from transaction history — but the address was a lookalike planted by an attacker, who had sent a 0.0002 USDC dust transfer from a vanity-matched address roughly 20 hours before the real transfer. The stolen USDC was swapped into DAI to hinder freezing. This is the textbook address-poisoning pattern: dust from an address sharing the first and last several characters, then reliance on a truncated display.
Commentary. This single case contains the whole playbook: the dust was cheap, the victim trusted a truncated string, and the recovery odds after a swap into DAI are poor. Copy addresses from a saved address book, verify the full string, and send a small test transfer first when amounts are large.
Coinbase impersonation actor moves ~$500k more into Tornado Cash; campaign total tops $300M
Summary. On-chain investigator VAL reported that a threat actor linked to more than $300M in thefts from Coinbase users converted roughly $500,000 into ETH and sent it to Tornado Cash, following a $2M routing three weeks earlier. The underlying thefts were social engineering: callers impersonating Coinbase support obtained credentials or talked victims into transfers and approvals. ZachXBT previously tied the cumulative losses to the same campaign. Coinbase warns that its staff never ask for passwords, 2FA codes or asset transfers.
Commentary. Support impersonation defeats people, not software. The rule that breaks the scam: no legitimate support team needs your codes, your remote access, or a 'safety transfer'. Hanging up and calling back through the official app costs nothing and would have saved eight figures across this campaign.
BounceBit halts its chain after an exploit involving ~$286M in BB tokens
Summary. BounceBit shut down its Layer 1 after an exploit involving approximately $286M worth of BB tokens was identified; reporting earlier in the week also described a ~$3M authorization flaw. The chain was taken offline while the team assessed damage and response options.
Commentary. A chain shutdown freezes every user's position, not just the exploited contract. It is one more argument for treating long-tail chains and restaking platforms as temporary parking, not storage.
The Sandbox contains a bridge exploit that minted 14.9B unbacked SAND via a hijacked delegate authorization
Summary. An attacker commandeered a LayerZero delegate authorization connected to The Sandbox bridge and minted roughly 14.9 billion unbacked SAND tokens. The team contained the incident; the exploit underlines how delegated validator/attester keys are themselves an attack surface that users cannot see when they sign a normal bridge deposit.
Commentary. From a wallet-operation view this is invisible risk: your signature on a bridge deposit is identical whether or not the bridge's delegate keys are secure. Size bridge positions accordingly.
Allbridge CCTP Router slow-drained $191k over a month
Summary. Allbridge's CCTP Router bled approximately $191,000 in what reporting described as a one-month 'slow play' — small repeated extraction rather than a single dramatic drain. Slow-drains are harder to detect precisely because they stay under alerting thresholds.
Commentary. For users the actionable part is monitoring: if you hold a position in a protocol, a small unexplained recurring outflow is a signal to exit first and investigate second.
Australia's ASIC reports 3,106 crypto investment scams shut down this fiscal year, up ~30%
Summary. Australia's corporate regulator ASIC said it shut down 3,106 crypto investment scam websites in FY26, up nearly 30%, within more than 19,400 total scams disrupted (up 182%). Deepfake-driven celebrity impersonation scams — including fakes of the Prime Minister — were reported to have cost Australians over $5.3M.
Commentary. Regulators disrupting domains after the fact does not reach victims' funds; the $5.3M figure is proof. The deepfake angle matters for wallet users directly: video calls and voice notes are no longer proof of identity, which is why the 'verify out-of-band' habit is now a baseline, not paranoia.
August runs well below July: 17 incidents and ~$18.8M before the Term drain
Summary. DefiLlama's tracker recorded 17 security incidents worth roughly $18.8M in August before the Term Finance drain; the Term loss alone pushes the month past $27M. July, by comparison, saw 38 incidents costing roughly $254M — including $116M attributed to a Coldcard wallet firmware flaw. SlowMist counted 182 incidents worth about $956M in H1 2026; Blockaid's H1 report put losses at $1.1B across 212 incidents, with private-key misuse accounting for roughly $790M.
Commentary. The mix matters more than the totals: the largest losses this year are key-compromise and firmware-class events, not contract exploits. Those are the categories where user operation — where keys live, which firmware you run, what you sign — is the entire defense.
Trust Wallet says it has detected 225M+ address-poisoning attempts; EVM-only coverage leaves TRON exposed
Summary. Trust Wallet reports its Address Poisoning Protection, launched in March, has detected over 225 million poisoning attempts with more than $500M confirmed stolen industry-wide — roughly 34,000 attempts per hour. MetaMask shows a warning when an address's first and last four characters match a previous recipient while the middle differs. Both protections operate mainly on EVM chains; TRON wallets have far less equivalent coverage.
Commentary. Wallet-level protection is arriving, unevenly. Until TRON-native coverage catches up, the burden sits on the user: address book entries, full-string verification, and a test transfer for large amounts. Our Weekly Operation Guide this week walks the full verification routine.
3. What Actually Prevented or Would Have Prevented This Week's Losses
Reading the ten items side by side, four defenses account for nearly every user-side dollar lost this week: (1) never copy recipient addresses from transaction history — use a saved address book and verify the full string; (2) never reach a financial platform through a sponsored search result — use a bookmark; (3) treat every new approval request as a decision, not a formality, and revoke stale approvals; (4) for support issues, hang up and call back through official channels. None of them cost anything. The protocol-level losses are different: they require diligence before depositing — governance participation, timelocks, bridge concentration — which we cover in the Weekly Safety Intelligence.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
What is address poisoning and why does it keep working?
An attacker sends tiny dust transfers from an address that shares its first and last characters with an address you have used before. If you later copy a recipient address from your transaction history, you may pick the attacker's address. It works because wallets display truncated addresses and users trust pattern recognition. Defense: save addresses in your wallet's address book and verify the full string before sending.
Was the Term Finance loss a wallet security failure?
No. It was a governance design failure — near-zero voting participation let a minimal attacker pass a malicious proposal. For users the exposure is indirect: funds deposited in a vault can be drained by governance capture, so check a protocol's governance design before depositing.
Are drainer attacks still a threat in 2026?
Yes, and they have industrialized. Drainer-as-a-service kits like Inferno are rented by affiliates who buy search ads and build cloned sites, while the toolkit handles approvals, sweeping, cross-chain movement and revenue splitting automatically. A single network investigated by Salus was linked to roughly $52.7M in losses.
This article is based on public data and official disclosures. Figures were last reviewed on August 24, 2026. Values change with network conditions; always verify against the primary source before making decisions.
BlockSec weekly security analysis (Term Finance and Maya Protocol, Aug 17–23, 2026).
BlockSec's weekly security analysis and SlowMist's incident tracker for the week of August 17–23, 2026: the spread of layer-level attacks that took the week's tally past $13M.
PeckShieldAlert's on-chain alert on the Bofur Capital mis-send (Aug 22, 2026) and on-chain investigator Specter's TRON address-poisoning tally (Aug 27, 2026); Trust Wallet's own Address Poisoning Protection disclosure (March 2026).
On-chain investigator VAL's tracing, with ZachXBT's campaign analysis (Aug 17, 2026): Coinbase impersonation actor linked to $300M+ in reported losses sends ETH to Tornado Cash.
BlockSec's analysis and DefiLlama's tracker for the Term Labs $8.5M loss (Aug 23-24, 2026), with SlowMist's H1 2026 report for the loss context.
ASIC's own enforcement announcement (Aug 17, 2026): 3,106 crypto investment scam websites shut down in FY26; deepfake-driven losses.
BounceBit's own chain-halt announcement and The Sandbox's containment notice, with BlockSec's weekly analysis (week of August 17–23, 2026): chain shutdown and bridge containment, plus the week's SEC and ETF context.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.