August 2026 will go down in crypto industry history as the month of peak hacker activity: 50 major hacks were recorded—an absolute record for the year. However, the total losses amounted to $136.3 million, which is 49.5% lower than July's figures. We are witnessing a unique trend: attacks are increasing, but their effectiveness is steadily declining.
My colleagues in blockchain security conducted a detailed analysis of incidents over the past month. The numbers reveal curious dynamics: attackers are acting more aggressively, but they are forced to settle for increasingly smaller hauls. This points to a qualitative improvement in defense mechanisms and faster validator response times.
August's biggest target—the Cronos ecosystem
The central event of the month was the attack on Tectonic, the largest lending protocol on the Cronos network. The attackers managed to withdraw approximately $74 million, making this incident the fourth-largest theft of the entire 2026 year. However, another fact is telling: the hacker was only able to convert about $6 million into Ethereum (ETH) before network validators urgently halted block production.
Cronos developers promptly rolled the network back to its pre-attack state and resumed block production, minimizing potential damage. This is a vivid example of how coordinated team efforts can mitigate the consequences of even the most massive exploits.
Statistics: quantitative growth amid qualitative decline
The 50 August incidents broke previous records set in April, May, and June, when 40 attacks were recorded monthly. For comparison, January, February, and March saw only 16, 15, and 20 hacks, respectively. Meanwhile, the average damage per attack fell to $2.7 million, compared to roughly $9 million in July.
The concentration of losses is telling: the top 10 incidents accounted for $123.34 million, while the remaining 40 attacks brought hackers only about $12.9 million. This confirms that most hacks today are either minor exploits or successfully thwarted attempts.
April remains the most "costly" month of the year with total damage of $646.89 million, primarily due to massive attacks on Drift and KelpDAO, which cost the industry approximately $577 million. In August, besides Tectonic, significant losses were suffered by Moonwell ($8.7 million), Term Labs ($8.5 million), Coinsbuy ($7.9 million), and TAC ($7.5 million). The top ten victims also included Injective, MANTRA, BounceBit, Cosmos Labs, and aquifer.
My analysis: The current dynamics are a positive signal for the market. A record number of attacks alongside a sharp decline in damage indicates that the industry has learned to detect and block suspicious activity faster. However, April's losses serve as a reminder: one successful exploit can negate months of progress. Investors should remain vigilant and diversify risks, especially when working with new DeFi protocols.