Wallet Security Data Report — August 24–30, 2026
This is our weekly data report: what was lost, where, by which attack type, and how the week compares with the weeks around it. Every figure carries its source and counting scope — protocol-level incidents and user-side theft are tracked separately.
This edition covers August 24–30, 2026.
1. The Week in Numbers
Tracked direct losses fell for a second consecutive week. The protocol ledger for the window: the Cosmos EVM integer-underflow bug ($5.72M in attacker proceeds across six chains, per the August 28 post-mortem; the exploits ran August 20–25), the Ajna lending exploit (~$775k), the Avici card-program breach ($500,859, fully refund-pledged), and the paired Enjin/FHToken exploits (~$182k) — roughly $7.2M combined. The disclosure side added the Salus attribution of a $550,019 USDC drainer theft, first reported publicly on August 24. Tracked total: approximately $7.7M, down roughly 37% from the prior week's ~$12.3M and down from the Aug 9–15 spike of more than $37M.
Counting scope is explicit: Zilliqa's post-mortem (published August 20, the prior window) quantified 683.13M ZIL of proven theft (~$1.84M at the ZIL price shown in coverage) — that loss accrued before this window and is not part of the weekly totals below. BounceBit's resolution — chain shutdown and BNB Chain migration after a ~$3M BB-token exploit — was also reported this week but the loss itself predates the window. Neither is counted here.
2. Incident Ledger
| Date | Target | Attack type | Est. direct loss | Class |
|---|---|---|---|---|
| Aug 24 | Salus attribution (theft Aug 13) | Drainer approval, fake search ad | $550,019 disclosed | User-side |
| Aug 26 | Enjin | Storage-slot manipulation | ~$162k | Protocol |
| Aug 26 | FHToken | Burn-logic flaw | ~$20k | Protocol |
| Aug 28 | Avici card program | Signature/collateral logic flaw | $500,859 (refund pledged) | User-side |
| Aug 28 | Cosmos EVM ecosystem (post-mortem) | Integer underflow (exploited Aug 20–25) | $5.72M | Protocol |
| Aug 29 | Ajna | Liquidation accounting manipulation | ~$775k | Protocol |
Also in the window, not counted as losses: Trail of Bits' zero-balance glitch (admin control of 82 assets reachable, ~$500k HASH escrow at risk, no exploitation confirmed), the Core Lightning emergency lockdown (no loss), the 40 malicious Firefox add-ons (Socket), and Ledger's Ethereum app patch. Attribution layer: the $9.4M TRON poisoning tally (four-week run rate, reported Aug 27).
3. Week-over-Week and Against the Baseline
The comparison series, each figure with its scope: Aug 9–15 — confirmed losses above $37M (whale repeat-phishing $25.6M, Coinsbuy $7.9M); Aug 17–23 — ~$12.3M tracked (Term $8.5M, Maya ~$1.7M, Bofur ~$2M); Aug 24–30 — ~$8.05M tracked. Three consecutive weekly declines, and the H1 2026 baseline (≈$42M per week per Blockaid; ≈$37M per week per SlowMist) now sits far above the last three weeks combined. August as a whole is closing far below July's $254M/38-incident pace.
The caveat repeats because it matters: weekly loss totals are the noisy signal. The mechanism mix barely moved, and the attribution disclosures this week — $52.7M tied to one drainer network, $9.4M to one TRON poisoning operator — show the underlying operations running at full industrial scale.
4. Attack-Type Distribution
Share of the week's ~$7.7M tracked direct losses:
| Attack type | Amount | Share | Note |
|---|---|---|---|
| Under-patched infrastructure bug | $5.72M | ≈74% | Cosmos EVM; fix did not cover all reachable paths |
| Lending/accounting logic | ~$0.775M | ≈10% | Ajna; one-hour warning went unheeded |
| Card/signature logic | ~$0.5M | ≈6% | Avici; full refund pledged within a day |
| Token contract logic | ~$0.18M | ≈2% | Enjin storage slots + FHToken burn logic |
| Drainer approval | $0.55M | ≈7% | Salus attribution (theft executed Aug 13) |
For the second straight week the largest single class was not a user-facing scam but a logic/infrastructure failure that user behavior cannot trigger — though user funds were the casualty in every case. Among user-facing mechanisms, the drainer attribution and the poisoning tally dominate: one network linked to $52.7M in cumulative losses, one poisoning operator at a $9.4M four-week run rate (≈$2.35M per week on TRON alone).
5. What Moved and What Did Not
- Down: total losses (−~35% WoW, third straight decline); no nine-figure incident.
- Up: attribution output — two major investigations (Salus, Specter) put nameable operators behind $62M+ in combined loss footprints this week.
- New signal: entropy attacks entered the quantified record — Coinspect tied $5.69M in losses to predictable seed generation across five wallet apps; Zilliqa's post-mortem put hard numbers on an entropy-disclosure bug (683.13M ZIL proven stolen).
- Flat: delivery channels — search ads, dust, impersonation all active; no new channel appeared.
6. Reading the Week
Two weeks of declining dollar losses with rising attribution output is the pattern worth naming: the industry is getting better at counting while attackers keep producing. For wallet users, the practical reads are unchanged — full-address verification, approval discipline, seed provenance — plus one new entry: seed-generation quality is now a documented loss category, so the provenance of the wallet software that created your phrase is part of your risk surface.
Frequently Asked Questions
How much was lost to crypto security incidents in the week of August 24–30, 2026?
Approximately $7.7M in tracked direct losses: ~$7.2M from protocol incidents (Cosmos EVM $5.72M, Ajna ~$775k, Avici $500,859, Enjin/FHToken ~$182k) plus the $550,019 drainer theft attributed publicly on August 24. Zilliqa's post-mortem (~$1.84M proven theft) and BounceBit's resolution relate to prior windows and are excluded from weekly totals.
Is August 2026 turning out safer than July?
On dollar totals, clearly: August is closing far below July's ~$254M across 38 incidents, and the last three weekly totals ($37M+, $12.3M, $8.05M) decline consecutively. The stable signals — mechanism mix and industrial attack operations — have not eased, so the quiet totals should not be read as a quieter threat.
What was the biggest loss this week?
The Cosmos EVM bug at $5.72M across six chains — a May patch that turned out not to cover every reachable code path. The largest user-facing loss was the $550,019 USDC drainer theft publicly attributed by Salus on August 24.
Sources & Methodology
This article is based on public data and official disclosures. Figures were last reviewed on August 31, 2026. Values change with network conditions; always verify against the primary source before making decisions.
- BlockSec weekly framework and prior-week tallies (Aug 17–23: ~$12.3M tracked) as published in this site's previous Data Report.
- Avici's own incident and refund notice ($500,859, 1,685 users, Aug 28, 2026); Defimon Alerts' timeline for the Ajna exploit (~$775k).
- CryptoSlate / Cosmos Labs post-mortem: Cosmos EVM bug, $5.72M in proceeds across six chains (Aug 28, 2026); Zilliqa post-mortem context (Aug 24–28, 2026).
- Enjin's own incident disclosure and SlowMist's contract analysis: Enjin ($162k) and FHToken ($20k) exploits (Aug 26, 2026).
- Salus Security's own attribution of the Inferno drainer network, $52.74M in linked losses (Aug 24, 2026).
- Specter's TRON address-poisoning tally: $9.4M across 15 victims (Aug 27, 2026).
- CryptoSlate: Coinspect predictable-seed research, $5.69M in losses (Aug 27, 2026).
- Zilliqa's own post-mortem (published Aug 20, 2026): 683.13M ZIL proven theft ≈$1.84M.
- BankInfoSecurity roundup (Aug 27, 2026): BounceBit chain shutdown and BNB Chain migration details.
- CoinGecko '2026's State of Crypto Security': 245+ incidents, $3.63B, audited-protocol share, insurance coverage.
Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.