This is our weekly review of wallet security: the incidents and disclosures that defined the past seven days, what actually happened in each case, and the one operation habit that would have helped. Every item is based on a disclosed source — security-firm reporting, official statements or on-chain investigators — and we label anything not yet confirmed.
This edition covers August 24–30, 2026.
1. The Week at a Glance
$5.69M
Lost to predictable seed phrases
Coinspect research, Aug 27
$9.4M
TRON poisoning tally, 15 victims
Specter, Aug 27
$52.7M
Losses linked to one drainer network
Salus attribution, Aug 24
$5.72M
Cosmos EVM bug, 6 chains
exploited Aug 20–25, post-mortem Aug 28
This week's defining story was not a single theft but a theme: randomness and verification are failing at the foundation layer. Coinspect documented $5.69M in losses tied to predictable seed generation across five wallet apps; Zilliqa's ledger-app post-mortem (published the prior week) kept drawing coverage for a flaw that discarded eight bytes of signing entropy; and Bitcoin's Core Lightning went into a 14-day emergency lockdown over AI-discovered bugs. Layered on top: a full drainer-network attribution, a TRON poisoning tally, and two fast, small protocol breaches to close the week.
Key takeaways
Entropy is the new supply chain: how your seed phrase and your wallet's signing nonces are generated now matters as much as how you store them.
Attribution is catching up: a single drainer network was linked to $52.7M in losses, and one TRON poisoning operator to $9.4M — industrial, nameable, and repeatable.
Fast response saves users money: Avici promised full refunds within a day of its breach; Ajna's unheeded one-hour warning shows the cost of the opposite.
Audit status is not a safety label: CoinGecko's year-to-date data shows audited protocols absorbed 88% of stolen capital.
2. Story Review
#1Aug 27WalletsResearchImpact High
Coinspect: $5.69M lost because five wallet apps generated predictable seed phrases
Summary. Security research firm Coinspect reported that crypto users lost at least $5.69M because their wallet seeds were too predictable: five wallet applications used vulnerable code that sharply reduced the randomness behind recovery-phrase generation. The finding reframes seed compromise as a supply-chain problem — the phrase a user diligently stored offline was never random enough to be safe in the first place.
Commentary. This is the most uncomfortable wallet-safety story of the year: users did everything right after generation and were still exposed. If you generated a seed with an unfamiliar or newly shipped wallet app, treat regeneration on a verified, established tool as a serious option — and demand entropy disclosures from vendors.
Salus attributes a $550,000 USDC theft to the Inferno drainer-as-a-service network
Summary. Security firm Salus disclosed that a fake Hyperliquid website promoted through paid Google search results took ~550,000 USDC from one victim on August 13; the theft was processed by drainer-as-a-service infrastructure closely linked to the Inferno ecosystem. Salus documented the full commercial package — scripts, admin panels, approval-command generation, one-time contract deployment, automated draining, cross-chain withdrawals, swaps, consolidation and automated 80/15/5 revenue sharing — and linked the infrastructure to roughly $52.74M in losses across multiple incidents. Google suspended the advertiser after the fact.
Commentary. The attribution turns 'drainers' from a category into a nameable industry with P&L mechanics. Defense stays unglamorous: never reach a financial platform through a sponsored result, and treat every approval request on a fresh domain as hostile.
Specter: one TRON address-poisoning operator drained $9.4M from 15 victims in four weeks
Summary. On-chain analyst Specter reported that a single address-poisoning operator on TRON drained approximately $9.4M from 15 victims over four weeks; two victims lost $2.5M each and another $2M. Proceeds were swapped into USDD and consolidated into a single aggregation wallet. Specter urged TRON wallet providers to implement interception measures and reminded users to verify recipient addresses in full.
Commentary. One operator, one technique, $9.4M — poisoning is not opportunistic noise, it is a business with a quarter-long run rate. Until TRON wallets ship the interception MetaMask and Trust Wallet offer on EVM chains, full-string verification and address-book discipline are the only reliable controls.
Solana neobank Avici breached for $500,859; pledges full refunds within a day
Summary. Avici, a Solana-based neobank, suffered an August 28 breach of its card program: attackers called a SubmitSignatures function on the authorization program, escalated via AddCollateralAdmin, then withdrew collateral. DefiLlama logged the loss at $500,859 across 1,685 users. On August 28 Avici said card-issuing partner Rain traced the flaw to a buggy Solana card contract version since upgraded, and committed to refunding all affected balances in full. The attacker wallet held about 10,005 SOL (~$1.07M); the AVICI token fell ~39%.
Commentary. The differentiator here was response speed: refund commitment inside 24 hours, contract upgraded across programs, and a precise affected-user count. Compare that with Ajna the next day (item 5) — response speed is now a measurable safety feature.
Ajna loses ~$775k to liquidation accounting manipulation — one hour after being warned
Summary. On-chain monitoring firm Defimon Alerts reported that Ethereum lending protocol Ajna lost about $775,000 to liquidation accounting manipulation, with the syrupUSDC pool alone accounting for $173,700. Defimon said it flagged the prepared attack more than an hour before the first exploit transaction and warned the team in Discord, but Ajna failed to react. Ajna confirmed it was investigating and urged users to withdraw funds and stop interacting with the protocol; its TVL had already fallen 71.3% over 30 days to ~$246,880.
Commentary. A one-hour warning that goes unread is the purest waste in security. For users, the lesson is uncomfortable: your funds' safety increasingly depends on whether protocol teams actually monitor the channels where warnings arrive.
Cosmos EVM: a misjudged bug sat for four months before $5.72M in proceeds was stolen across six chains
Summary. Cosmos Labs' August 28 post-mortem reported that attackers extracted $5.72M in proceeds across six chains (exploits ran August 20–25) using an integer-underflow flaw in the shared Cosmos EVM module. The bug was reported via the bug bounty program on April 25 but misjudged as harmless to production chains, patched silently in May — and the patch later proved broader than engineers initially believed.
Commentary. Patching is not a switch; it is a coverage question. Users of multi-chain ecosystems should note that a fix on one chain does not immunize forks and consumers of the same code elsewhere — and neither does an audit, which speaks to the code as understood at the time.
Enjin ($162k) and FHToken ($20k) exploited on the same day via storage-slot and burn-logic flaws
Summary. Two small smart-contract exploits landed on August 26. Enjin reported ~$162,000 lost after attackers manipulated storage slots to gain managerial control and registered a malicious adapter to siphon assets. Separately, FHToken lost ~$20,000 through a flawed _transfer function with isSell logic that incorrectly burned tokens and drained the FH/USDT PancakeSwap V2 pool via looping buy/sell transactions.
Commentary. Small in dollars, useful in pattern: both are logic-layout failures rather than novel cryptography. For users, they reinforce that token contracts you interact with — especially deflationary tokens — deserve a contract check on the explorer, not just a ticker match.
Trail of Bits: a zero-balance glitch could hand admin control of 82 crypto assets
Summary. Trail of Bits disclosed a flaw by which empty wallets could steal admin control of 82 crypto assets: the issue put token supply and about $500,000 of HASH escrow at risk, though no exploitation was confirmed. The bug class — administrative control reachable from a zero-balance account — is the kind of edge case that survives normal testing.
Commentary. For token holders, this is a reminder that 'who holds the admin keys' is a live question for every asset you hold, and the answer can change without your signature.
Socket: 40 malicious Firefox add-ons targeted crypto wallets; 9 began as sports-score tools
Summary. Socket confirmed 40 malicious Firefox add-on IDs targeting crypto wallets, nine of which began as sports-score tools before being updated to steal wallet secrets. The report stressed that exposed crypto wallet secrets still require migration after the add-ons are removed — cleanup does not undo the exposure.
Commentary. Two practical points: browser extensions can update into malware, so review permissions even on long-installed tools; and if an extension could read a seed, removal is not remediation — move funds to a fresh seed.
AI-found bugs force Bitcoin's Core Lightning into a secret 14-day emergency lockdown
Summary. Core Lightning, Bitcoin's leading Lightning Network implementation, urged node operators to upgrade or go offline as multiple vulnerabilities remained under embargo, following what reporting described as an onslaught of AI-discovered bugs and a secret 14-day coordinated lockdown. Related coverage examined how a quiet flaw in Bitcoin's top scaling network left some user funds exposed to wipeouts, with the fix arriving later than the disclosure timeline suggested.
Commentary. AI is now on both sides: generating novel bug finds faster than disclosure processes were designed for. Node operators should treat 'upgrade immediately' advisories as same-day actions.
Ledger patches an Ethereum app bug that could show one transaction and sign another
Summary. Ledger patched an Ethereum application bug that could display one transaction while signing a different one — the exact failure mode that makes hardware-wallet screens untrustworthy. Days later, Ledger disputed a researcher's framing of a separate viral 'hack' claim while closing two real Ethereum signing vulnerabilities.
Commentary. The show-one-sign-another class is the hardware wallet's nightmare scenario, and it was fixed before being abused in the wild — but the episode reinforces the rule: read the device screen every time, and keep firmware and apps current.
Fraud convictions land: Profit Connect founder guilty of $24M scheme; Block Bits Capital founder convicted
Summary. A federal jury convicted Las Vegas businessman Brent C. Kovar of defrauding at least 400 investors of $24 million through Profit Connect, which falsely claimed AI-powered mining and federal deposit insurance; he faces up to 280 years. Separately, Block Bits Capital founder Japheth Dillman was convicted of wire fraud over a fake automated trading fund that took nearly $1M from 20+ investors. In related legal news, Tornado Cash developer Roman Storm's retrial was delayed until April 2027.
Commentary. Convictions arrive years after the money leaves — enforcement is retrospective, not protective. The fake 'AI-powered returns' pitch also foreshadows this week's other story: AI used to convince users to run their own scams, covered in the Weekly Safety Intelligence.
A CoinGecko report titled '2026's State of Crypto Security' documented more than 245 incidents between January 2025 and July 2026, totaling $3.63B in losses. Two data points stand out for wallet users: 147 of the incidents hit audited protocols — accounting for 88.44% of all stolen capital, because audits cannot cover infrastructure, third-party services, governance or human error — and active on-chain insurance coverage has fallen to 20.2% of the market ($163.2M to $130.2M), with five of nine on-chain insurance protocols inactive or pivoted by August 2026. The safety net is thinner than most users assume; the habits are the net.
As always: if an incident in this review is later shown to be materially different from the initial disclosure, we will correct it in the next edition and note the change.
Frequently Asked Questions
What is a 'predictable seed phrase' and how do I know if mine is one?
A predictable seed comes from wallet software whose random number generation is weak or flawed, so the recovery phrase was far easier to guess than the expected 1-in-2^128 odds. Coinspect documented $5.69M in losses from five such wallet apps. You cannot reliably detect it after the fact — which is why generating seeds with established, long-audited wallet software (ideally a hardware wallet) and keeping firmware current matters.
What is drainer-as-a-service?
A criminal subscription model in which toolkit developers rent out wallet-draining infrastructure — approval generation, deployment, sweeping, laundering and profit-splitting — to affiliates who run the phishing campaigns. The Salus attribution documented an 80/15/5 automated revenue split and linked the network to roughly $52.7M in losses.
How do I protect myself from address poisoning on TRON?
Save every regular payee in your wallet's address book, verify the full 34-character address on first payment and before large sends, treat any incoming dust transfer from a lookalike address as an attack signal, and send a small test transfer first. Wallet-level interception on TRON is still limited compared with EVM wallets, so verification habits carry the load.
This article is based on public data and official disclosures. Figures were last reviewed on August 31, 2026. Values change with network conditions; always verify against the primary source before making decisions.
CryptoSlate (Aug 24–28, 2026): Coinspect predictable-seed research; Cosmos bug; Enjin and FHToken exploits; Trail of Bits disclosure; malicious Firefox add-ons (Socket); Core Lightning lockdown; Ledger Ethereum app patch.
Salus Security's own investigation, published on X (@salus_sec, Aug 24, 2026): the Inferno drainer-as-a-service network.
Specter's TRON address-poisoning tally (Aug 27, 2026): $9.4M across 15 victims in four weeks.
Avici's own incident and refund notice (Aug 28, 2026); Defimon Alerts' warning timeline for the Ajna exploit (Aug 29, 2026).
Enjin's own incident disclosure and SlowMist's contract analysis of the FHToken _transfer flaw (Aug 26, 2026).
BankInfoSecurity roundup (Aug 27, 2026): Profit Connect and Block Bits Capital convictions; Roman Storm retrial delay; BounceBit resolution.
CoinGecko '2026's State of Crypto Security': 245+ incidents, $3.63B, audited-protocol share and on-chain insurance coverage data.
OSW
The OpSecWallet Research Team
We are an independent research desk focused on wallet security and safe on-chain operation. Every report is written from public data and official security disclosures, cross-checked against primary sources, and reviewed for accuracy before publication. We never ask readers for keys, seeds or transfers.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.