August became an unprecedented month for the crypto industry in terms of the number of hacker attacks: 50 major hacks were recorded — an absolute record for the entire year of 2026. However, despite the surge in malicious activity, total losses fell to $136.3 million, which is 49.5% lower than July figures.
The Security Paradox: More Attacks, Fewer Losses
My data analysis shows an interesting dynamic: the frequency of incidents is rising, but their effectiveness for hackers is declining. The average damage from a single attack in August was only $2.7 million, while in July this figure reached approximately $9 million. This indicates a qualitative improvement in protective mechanisms and faster team responses to incidents.
The key event of the month was the hack of the Tectonic protocol — the largest lending protocol on the Cronos blockchain. Attackers managed to withdraw about $74 million, making this incident the fourth-largest theft of the entire year of 2026. Notably, the hacker managed to convert only about $6 million into Ethereum (ETH) before validators promptly halted the network.
“The hacker began laundering stolen funds by transferring them through a bridge to the BTC network (approximately 200,000 so far),” security experts noted.
Cronos developers took emergency measures: they rolled the network back to its state before the attack began and resumed block production. This shows that even with serious vulnerabilities, effective emergency response mechanisms exist.
Structure of August Attacks
August's 50 incidents significantly exceeded the figures for April, May, and June, when 40 attacks were recorded monthly. In January, February, and March, PeckShield recorded 16, 15, and 20 hacks, respectively. The top 10 incidents accounted for $123.34 million in damage, while the remaining 40 attacks brought hackers only about $12.9 million.
April remains the “worst” month of the year: total damage amounted to $646.89 million, primarily due to major attacks on Drift and KelpDAO, which netted attackers approximately $577 million.
Among other notable victims in August are Moonwell, which lost $8.7 million, Term Labs with $8.5 million in damage, Coinsbuy — $7.9 million, and TAC — $7.5 million. The top 10 also included attacks on Injective, MANTRA, BounceBit, Cosmos Labs, and aquifer.
My expert assessment: The decline in average damage amid a rise in the number of attacks is an encouraging trend, indicating the industry's maturation. However, April's losses serve as a reminder: one successful hack can negate months of progress. Investors should remain vigilant and diversify risks, while projects should invest in preventive security measures, not just reactive protocols.