Wallet Security Data Report — August 17–23, 2026
This is our weekly data report: what was lost, where, by which attack type, and how the week compares with the weeks around it. Every figure carries its source and counting scope — protocol-level incidents and user-side theft are tracked separately, because they fail for different reasons and need different defenses.
This edition covers August 17–23, 2026.
1. The Week in Numbers
The week was quiet by 2026 standards. BlockSec recorded exactly two major protocol incidents in the window — Maya Protocol (~$1.76M direct) and Term Finance (~$8.5M) — for roughly $10.3M in combined direct losses. On the user side, we track one verified theft in the window: the ~$2M Bofur Capital address-poisoning loss (Aug 22). Combined tracked losses: roughly $12.3M.
Counting scope matters and we keep it explicit: BounceBit's chain shutdown over an exploit involving ~$286M in BB tokens is reported in weekly recaps for this window, but the ultimate loss figure and whether tokens were actually extracted remain unclear — so we flag it as an availability event, not a confirmed loss, until primary numbers land. The Sandbox bridge mint (14.9B unbacked SAND) was contained with no direct user loss reported.
2. Incident Ledger
| Date | Target | Attack type | Est. direct loss | User-side? |
|---|---|---|---|---|
| Aug 18 | Maya Protocol | Chained logic/accounting bugs | ~$1.7M (pool damage up to ~$11M) | No |
| Aug 22 | Bofur Capital | Address poisoning | ~$2M | Yes |
| Aug 22 | The Sandbox bridge | Delegate authorization hijack | Contained; no direct loss | No |
| Aug 23 | Term Finance | Governance capture | ~$8.5M | No |
| Ongoing | Allbridge CCTP Router | Slow drain | ~$191k over a month | No |
3. Week-over-Week and Against the Baseline
The comparison series, each figure with its scope: the prior week (Aug 9–15) saw confirmed losses above $37M across multiple incidents — driven by the $25.6M repeat phishing drain of a whale wallet (Aug 12) and the $7.9M Coinsbuy payment-processor theft (Aug 9). This week's ~$12.3M tracked total is a decline of roughly 67%. Against July — 38 incidents and ~$254M for the month, about $59M per week — the week runs at roughly a fifth of the July weekly pace.
The H1 2026 baselines make the same point from a different angle: Blockaid counted $1.1B across 212 incidents for the half (≈$42M per week) and SlowMist counted $956M across 182 incidents (≈$37M per week). A ~$12M week is well below both. One quiet week is weather, not climate — August's month-to-date total still climbed past ~$27M once the Term loss landed, against July's $254M — but the direction of the last two weeks is clearly down from July's spike.
4. Attack-Type Distribution
Share of the week's ~$12.3M tracked direct losses:
| Attack type | Amount | Share | Note |
|---|---|---|---|
| Governance capture | ~$8.5M | ≈69% | Term Finance; attacker cost ~0.5 ETH |
| Address poisoning | ~$2M | ≈16% | Bofur Capital; dust 20h before the real transfer |
| Logic/accounting bugs | ~$1.9M | ≈15% | Maya (~$1.7M) + Allbridge slow drain (~$191k) |
The distribution is the week's real story. Governance capture — rare but expensive — was the single largest class, consistent with DefiLlama's 2026 tally of five governance incidents worth $25.1M combined (led by the $20M BonkDAO proposal attack in July). On the user side, address poisoning took the largest single loss, and the Bofur case showed the mechanism operating exactly as investigators have described it all year: cheap dust, a truncated display, and one pasted address.
5. What Moved and What Did Not
- Down: total losses (−~67% WoW) and protocol exploit count (2 vs 5+ the prior week).
- Up: governance capture's share of losses (the Term case alone out-sized every other class); the speed of laundering in the in-window poisoning case (stolen USDC swapped to DAI within hours of the paste).
- Flat: the delivery channels — search ads, dust transfers and support impersonation all remained active; no new delivery channel appeared this week.
- Anomaly watch: the Term case is the second 2026 incident where near-zero governance participation enabled a minimal-cost attacker; if a third appears, we will start tracking 'governance participation' as a standing risk metric for vault depositors.
6. Reading the Week
For protocol depositors, the week says process risk now outranks code risk at the losing end of the distribution: both major incidents were design-and-process failures, not novel exploits. For individual wallet users, the week says the volume threat is unchanged even when the dollar total dips — poisoning attempts run at industrial scale (Trust Wallet reports 225M+ detected industry-wide), and the Bofur case shows a $2M loss needs nothing more than one address copied from history. Dollar totals are the noisy signal; mechanism mix is the stable one, and the mechanism mix barely moved this week.
Frequently Asked Questions
How much was lost to crypto security incidents in the week of August 17–23, 2026?
Roughly $12.3M in tracked direct losses: ~$10.3M from two protocol incidents (Maya Protocol, Term Finance) plus ~$2M in user-side theft (the Bofur Capital poisoning case). Counting scope is explicit in the report; some events reported this week, like the BounceBit shutdown, are not counted as confirmed losses.
Which attack type caused the most losses this week?
Governance capture — the Term Finance drain of ~$8.5M was about 66% of tracked losses. Among user-facing mechanisms, address poisoning led, including a ~$2M single loss.
Are wallet security losses going down?
The last two weeks declined sharply from July (≈$254M across 38 incidents) and from the Aug 9–15 spike (>$37M). But week-to-week loss totals are noisy; the attack mechanisms — poisoning, approval drainers, impersonation — remained fully active at industrial scale.
Sources & Methodology
This article is based on public data and official disclosures. Figures were last reviewed on August 25, 2026. Values change with network conditions; always verify against the primary source before making decisions.
- BlockSec weekly security analysis: Term Finance and Maya Protocol incident figures (Aug 17–23, 2026).
- BlockSec's weekly analysis with BounceBit's and The Sandbox's own notices (August 17–23, 2026): incident ledger for the week.
- PeckShieldAlert's on-chain alert on the Bofur Capital $2M mis-send (Aug 22, 2026); Trust Wallet's own 225M+ detection statistic.
- AVOID incident timelines citing PeckShield/CertiK: Aug 9–15 weekly losses >$37M; whale repeat-drain $25.6M; Coinsbuy $7.9M.
- DefiLlama's tracker for the August month-to-date (17 incidents, ~$18.8M pre-Term) and July (38 incidents, ~$254M) counts.
- Blockaid H1 2026 report ($1.1B / 212 incidents) and SlowMist H1 2026 report ($956M / 182 incidents) as baselines.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.