August Set a Record for Crypto Hacks. The Money Lost Wasn't the Point.

Crypto ended August with a number that looks alarming and a number that looks reassuring, and the two belong to the same story. Blockchain security firm PeckShield counted 50 major incidents in August — the most of any month in 2026 — yet the estimated $136.3 million extracted was down by nearly half from July's roughly $270 million. Most of that figure came from a single event: a ~$74 million drain of the Tectonic lending protocol on the Cronos chain. The second-biggest hit, $8.7 million, landed on Moonwell, a lending protocol on Coinbase's Base network.

Those two attacks had more in common than the calendar. Neither required anyone to break a line of smart-contract code. In both cases, an attacker pumped the price of a thinly traded token, deposited the now-inflated coins as collateral in a lending market, and borrowed genuine assets — bitcoin, ether, stablecoins — against a valuation the market never supported in the first place.

The Tectonic attack is the cleaner example, because its mechanics are on record. TONIC, the protocol's own governance token, traded with roughly $1.34 million of liquidity and daily volume near $11,000. The attacker ran its price up about 100-fold in roughly 20 minutes, then borrowed against it. Tectonic had assigned TONIC a 20% collateral factor — meaning depositors were allowed to borrow up to a fifth of the token's inflated value — which was far more than the token's real worth could back. By the time the theft was over, onchain analysis put the gross outflow from the lending pools near $120 million. Only about $6 million of the proceeds made it across a bridge to Ethereum; Cronos validators halted the entire chain, stranding roughly $60 million. The network later restored its state to before the attack and resumed producing blocks, effectively reversing the theft for onchain balances.

None of this is new mechanism. Researchers compared it directly to the Mango Markets exploit of October 2022, which used the same pump-and-borrow construction. It keeps returning for a reason worth an investor's attention: lending protocols keep admitting small, illiquid tokens as collateral and pricing them through oracles that a few million dollars of capital can move.

Moonwell shows why the trick stays profitable. The attacker pushed MAMO, a small Base token, from about $0.011 to roughly $0.088 — an eightfold jump — against a market so thin that $1.18 million in daily volume could move it, and beyond reach of any time-weighted average price guard. The roughly $8.7 million the attacker walked away with exceeded Moonwell's annualized fee revenue of about $8.6 million: one morning's theft was larger than a full year of the business's income. It was also the protocol's third oracle-class failure in under a year, cumulatively worth about $11.5 million. Moonwell responded by cutting borrowing caps on every Base core market to near zero.

That last comparison is the economic core of the month. Decentralized lending platforms collect fees that are a poor price for the tail risk they carry. A single successful price-manipulation run can erase a year (or more) of what the protocol earns. The "yield" these markets pay to lenders is partly compensation for exactly this risk — and lenders are deciding, transaction by transaction, whether the premium is enough.

Now pull back to the full year, because August was not an accident. It is the pattern of 2026. Security firm TRM Labs counted 207 hacks in the first half, a record for any six-month period and more than double the 83 incidents in the first half of 2025. Total stolen dollars fell the other way: $972 million versus $2.3 billion a year earlier. The median hack took just $219,000. The distribution behind those averages is two separate populations: smart-contract exploits accounted for 125 of the 207 incidents but a small share of the dollars, while infrastructure and signing-key compromises were roughly 15% of incidents and about 76% of losses. North Korea-linked actors took about $643 million — 66% of first-half losses — down from around $1.7 billion a year earlier, with the Drift and KelpDAO attacks alone combining for roughly $577 million in April.

So the honest reading of the August headline is the opposite of its surface. Attack frequency is at a record while the average loss keeps falling. The system is not leaking more value — it is spreading a relatively stable bill across far more targets. Set $136.3 million against total crypto market cap of about $2.6 trillion and the month's entire hack toll is roughly 0.005% of the market. Illicit volume as a share of total crypto volume actually fell in 2025, to about 1.2% from 1.3%.

That framing matters, and so does its limit. The aggregate is contained; individual platforms are not. Strip out Tectonic and the remaining 49 incidents combined for only about $62 million — a long tail in which most of the rest was itself a handful of events. The market's responses — chain halts, state rollbacks, emergency borrow caps — are working well enough to hold down the total, but they concentrate authority in a handful of operators: Cronos could flatten its entire chain because it runs on a small set of permissioned validators. Every new lending market, every new token admitted as collateral, is a new place where the same old trick can be run again.

The deeper scar from August is not found in PeckShield's tally. Before the exploit, Tectonic held roughly $121.7 million in deposits and about $82.7 million in active loans — nearly half of all capital in Cronos DeFi. By the next day its deposits had collapsed by about 97.5%, to roughly $3 million, even though the chain-level rollback largely undid the theft itself. The hack's permanent economic damage was the run on the protocol — the loss of trust — not the gross number in the security report. That is the pattern a venture analyst recognizes as the difference between a headline loss and a destroyed business.

Where does that leave an investor? The recurring failure is identifiable enough to avoid: lending markets that accept new or illiquid collateral priced by manipulable spot oracles are where the game is still winnable, and the advertised yield there is a price for standing on that risk. Custody changes exposure too — in the Tectonic case, funds held on the Crypto.com app and exchange were untouched while depositors' onchain positions sat frozen through the halt. And the money these attacks take keeps paying the industry's security layer — the monitoring, analytics, and audit firms that count, track, and investigate the losses — which is where a durable share of the value tends to accumulate.

The useful boundary, then, is this: crypto's security problem is not a draining wound that threatens the asset class. It is a steady tax, falling across far more targets, with the risk concentrated in identifiable corners where users can choose not to sit. The monthly loss headlines will keep arriving — August set the record for incidents this year, and the count is still climbing. The scoreboard worth watching is not the dollar total. It is whether lending platforms stop pricing their borrowers' collateral at valuations their own markets cannot liquidate.