August 2026 became a historic month for the crypto industry in terms of the number of incidents, but not their scale. 50 major hacks were recorded—an absolute record for the year. However, the total damage amounted to $136.3 million, which is 49.5% lower than July's figures. This is a clear signal: the frequency of attacks is rising, but their effectiveness for attackers is falling.
My analysis of blockchain ecosystem security data reveals curious dynamics. In April, May, and June, we observed 40 incidents per month, while in January, February, and March—only 16, 15, and 20, respectively. The sharp jump to 50 hacks in August suggests that hackers have adapted to new realities, but their "loot" is becoming increasingly lean.
Largest incident of the month: Cronos and Tectonic
The main event of August was the hack of Tectonic—the largest lending protocol on the Cronos blockchain. Attackers managed to withdraw about $74 million, making this incident the fourth-largest theft for the entire 2026. However, it is telling that the hacker was only able to convert roughly $6 million into Ethereum (ETH) before network validators urgently halted block production.
Cronos developers promptly rolled the network back to its state before the attack and resumed block issuance. This demonstrates that infrastructure projects have learned to respond quickly to threats, minimizing losses.
Average damage collapsed, top-10 dominates
The average damage per attack dropped to $2.7 million, compared to about $9 million in July. Notably, the top-10 incidents accounted for $123.34 million—90% of all losses for the month, while the remaining 40 attacks yielded only $12.9 million. Such concentration indicates that successful hacks require serious preparation and targeted work on vulnerabilities.
In addition to Tectonic, the top ten largest losses included Moonwell ($8.7 million), Term Labs ($8.5 million), Coinsbuy ($7.9 million), and TAC ($7.5 million). Injective, MANTRA, BounceBit, Cosmos Labs, and aquifer were also affected.
April remains the "blackest" month of the year: losses then reached $646.89 million, primarily due to attacks on Drift and KelpDAO, which brought hackers about $577 million. Against this backdrop, August looks almost calm.
My expert assessment: the decline in damage amid a rise in the number of attacks is a positive trend, but it should not be a cause for complacency. Hackers are clearly testing new vectors, and we could see a new wave of major hacks once they find weak spots in DeFi protocols. Investors should pay closer attention to audits and risk insurance.