tac

According to Slow Mist monitoring, Float Protocol suffered a flash loan attack, resulting in a loss of approximately $28,000 (10.71 ETH). The attacker manipulated the Uniswap V3 spot price (slot0) through a flash loan, leading to incorrect pricing of LP shares in the Hypervisor contract, with key functions lacking TWAP/oracle verification and slippage protection mechanisms.The attacker distorted the values of currentTick() and getTotalAmounts() by making large trades in the V3 liquidity pool, then repeatedly deposited and withdrew the inflated share value to arbitrage.

According to ZEIT, the Berlin city government suffered a cyber attack two weeks ago, and the hacker group is suspected of implementing ransomware using the stolen data. According to Der Spiegel, the attackers are believed to be the long-active Rhysida hacker group, demanding a payment of 30 bitcoins (approximately 2 million euros) and threatening to release the data.The sensitive information involved may include records of violations and passwords. The Berlin state government has not yet confirmed the extent of the data breach and has not responded to the ransom amount or the identity of the attackers, stating that it will not comment "for reasons of investigative strategy." Berlin's mayor, Kai Wegner, has made it clear that Berlin will not yield to extortion. The main departments affected are transportation and construction management, which were temporarily isolated from the state government's network after the incident.

Blockchain security company Blockaid reported that it has detected an exploit on More Markets (More Labs) on the Flow EVM. The attacker successfully drained More Markets' WFLOW lending reserves by exploiting Ankr's bound LST (liquid staking token) and the E-Mode mechanism.According to Blockaid's monitoring, the attacker transferred approximately 15.5 million WFLOW from the mFlowWFLOW reserves, with the detected impact amounting to about 9.3 million USD. The related attack transaction cluster also includes fund transfer operations following the exploit. The specific losses from the incident and the whereabouts of the attacker’s funds are still under further confirmation.

The Cronos network associated with Crypto.com has paused operations after detecting an attack on the lending protocol Tectonic. The Cronos Network stated on the X platform that it has identified vulnerabilities on Tectonic and has paused the network. Tectonic also confirmed that it is investigating the related incident and advised users not to interact with the protocol until safety is confirmed. According to DefiLlama data, Tectonic had a total locked value of approximately $121.7 million before the incident, with active loans of about $82.7 million.On-chain researcher Weilin Li attributed the attack to price manipulation of the TONIC token. The attacker bought enough TONIC within 20 minutes to inflate its price by about 100 times, and then used the inflated tokens as collateral to borrow other assets from Tectonic, a method similar to the 2022 Mango Markets oracle manipulation attack. Li initially estimated that the attacker profited about $66 million, and later discovered another address controlled by a different attacker containing about $8 million, bringing the total estimate to around $75 million. Li also stated that the attacker only successfully bridged about $6 million to Ethereum, as the pause on the Cronos network prevented most affected assets from flowing out.Crypto.com CEO Kris Marsalek stated that the company's app and exchange were not attacked, and its security team is assisting Tectonic with the investigation.

The sandwich attack bot operated by JaredfromSubway.eth has extracted a total of 117,007 ETH since March 2023, amounting to approximately $295 million at current prices. In June 2026, an anonymous attacker deployed 66 counterfeit token contracts, using the bot's automated trading logic to steal at least $7.5 million in ETH and stablecoins, transferring the funds to Tornado Cash; the related assets have not yet been recovered.Sandwich attacks are a form of Maximum Extractable Value (MEV): the bot monitors large transactions in the Ethereum public mempool, buys before the target transaction, and sells after the transaction drives up the price, extracting profits from the price difference. As of August 28, the main contract of the bot has received a total of 117,007 ETH.MEV-Boost block construction is concentrated among a few participants, with relay.ultrasound.money, Titan Relay, and bloXroute relays forwarding approximately 85% to 88% of the relevant blocks within a 24-hour window; Titan's builders independently assemble 50.3% of the blocks. The monthly extraction amount from sandwich attacks has decreased from about $10 million at the end of 2024 to about $2.5 million in October 2025.

Cosmos Labs released a technical report, admitting that it previously misjudged an integer underflow vulnerability in the Cosmos EVM, which led to attacks on six blockchain networks between August 20 and 25, resulting in a total theft of approximately $5.7 million in tokens. The attacker exploited the vulnerability to underflow account balances to the maximum value of 2^256-1, then performed a reverse operation to transfer the inflated balance out, thereby stealing tokens from the target accounts without creating tokens out of thin air.The report shows that researchers submitted the defect through a bug bounty program on April 25, but testers were unable to reproduce it on the existing Cosmos chain configuration, so Cosmos Labs silently patched it in May. Independent researchers confirmed in early August that the vulnerability affected all Cosmos EVM chains, and Cosmos Labs released a patch on August 19, but the first attack occurred about 20 hours later.In terms of specific losses, MANTRA lost 720.9 million tokens (approximately $3.6 million), TAC lost nearly 3 billion TAC, and KiiChain lost about 148 million KII. Both MANTRA and KiiChain criticized Cosmos Labs for not notifying the affected chains in advance and suggesting a shutdown, with KiiChain stating that the patch would take several days to deploy while a shutdown would only take a few minutes. Cosmos Labs stated that it has coordinated responses with 40 chains and assisted 13 chains in completing repairs or shutdowns before being attacked.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

Ajna stated that the protocol was attacked due to a vulnerability, and they are currently investigating abnormal fund flows. They recommend that users withdraw all funds, repay loans, and suspend interactions with the protocol.This incident involves liquidity pools such as syrupUSDC, wstETH, rETH, cbETH, WBTC, WETH/USDC, sDAI, with losses of approximately $775,000, attributed to a liquidation accounting manipulation attack.

An unknown attacker has breached the Fogo Foundation, transferring approximately 400 million FOGO tokens to a malicious address. The Fogo Foundation has notified major exchanges and is in communication with law enforcement and blockchain forensic experts.This incident will not affect the Fogo blockchain itself, and the network is currently operating normally. The Fogo Foundation will announce further developments once more information is available.

According to Onchain Lens monitoring, Avici was attacked, resulting in a total loss of approximately $1.02 million. The attacker transferred 10,000 SOL to another wallet and exchanged it for about 1.02 million USDC, then transferred it through a cross-chain bridge and exchanged it for approximately 418 ETH.

Zhao Changpeng recently commented on the emotional and property disputes related to Sun Yuchen, stating that while aggressive marketing can be acceptable, there is no need to use the incident for personal attacks or to affect others' future career development. Instead of disclosing unnecessary details, it is better to resolve the matter directly through legal means. He hopes both parties can handle it properly and respect each other.Zhao Changpeng then added that the cryptocurrency industry should set higher standards for itself. In response, Sun Yuchen expressed agreement, stating, "Mutual respect, proper resolution, and leave the rest to the court; I won't say more."

Solana's new bank Avici is facing ongoing attacks, with attackers having stolen over $1 million from users. The attackers' wallet holds 10,005.03 SOL (approximately $1.07 million) and about $11,600 in USDC and USDT. The attack method involves first calling the SubmitSignatures of the Avici authorization program, then calling the AddCollateralAdmin of the collateral program, and finally executing WithdrawCollateralAsset to withdraw the balance. Both of Avici's programs are upgradable and share the same standard Solana account instead of multi-signature upgrade permissions.Avici confirmed the incident 1 hour and 53 minutes after the first theft transaction, stating, "We are aware of the issue affecting card balance withdrawals and are working directly with all relevant partners to resolve it." Prior to this, users had reported stolen balances on social media. A real-time tracker established by anonymous on-chain analyst STACC recorded 125 different sending accounts, with transfer amounts ranging from approximately 9 USDC to over 26,000 USDT.As a result, the AVICI token fell 49.4% in 24 hours to $0.2175, with a market cap of approximately $2.84 million, hitting an all-time low. Avici raised funds through MetaDAO in October 2025, with an original cap of $3.5 million, but the final committed amount reached $34.2 million, and the team refunded 89.8% of the committed USDC.

On August 20, MANTRA Chain released a complete review report of the security incident, confirming that the attacker exploited an unsigned integer underflow vulnerability in the balance accounting layer of the upstream dependency cosmos/evm, unauthorizedly transferring a total of 720,923,967.99 MANTRA from two addresses, valued at approximately 3.6 million dollars based on the price before the attack. Among them, the attacker transferred 600,000,035.56 MANTRA from the on-chain burn address and 120,923,932.44 MANTRA from a genesis-era multi-signature address related to an early incentive program.MANTRA stated that this incident did not involve the leakage of validator keys, administrator privileges, governance control, or multi-signature signers; the attacker did not require privileged access and could complete the attack solely through unauthorized contract deployment and self-funded wallets. The first abnormal transfer occurred at 19:06 UTC on August 20, when the attacker transferred approximately 600 million MANTRA from the burn address; subsequently, at 22:59 UTC, another transfer of approximately 120.9 million MANTRA was made. The chain subsequently stopped operating at 23:13 UTC and resumed after upgrading to v8.4.0. The entire network interruption lasted for 30 hours and 13 minutes.This vulnerability was not an issue with MANTRA's self-developed code but originated from the cosmos/evm module, which is responsible for providing EVM functionality on the Cosmos SDK. The vulnerability allowed the attacker to execute unsigned balance deductions without checking if the balance was sufficient, causing an overflow of values and bypassing normal account authorization logic. MANTRA stated that as of today, no funds have been recovered, with approximately 37.96 million MANTRA (accounting for 5.27% of the total transferred) still remaining in the attacker's address, which has been frozen due to the chain's suspension and v8.4.0 restrictions. The remaining funds have flowed to related trading platforms, and the recovery efforts have entered the law enforcement investigation stage. In the future, monitoring of accounts that cannot normally authorize transfers, burn addresses, and other historically "non-transferable" addresses will be strengthened, and efforts will be made to promote improvements in the security vulnerability disclosure process within the Cosmos ecosystem.

The cryptocurrency exchange Kraken recently temporarily locked some customer accounts due to nearly 12,000 small transfers sent from wallets marked by Arkham Intelligence as belonging to competitor HTX to Kraken-associated addresses between August 17 and 24. Each transfer ranged from a few cents to several dollars. Kraken stated that this method, known as dusting attacks, exploits the arbitrary transfer characteristics of public blockchains to associate sanctioned funds with unrelated users, thereby triggering sanction screening mechanisms.The Kraken compliance team has restored user access while continuing to freeze the relevant sanctioned funds and cooperating with authorities to ensure the attack does not achieve its intended effect. HTX responded that an internal review found no official accounts involved in the related small transactions and is investigating whether the sending wallets were misidentified or operated by third parties. The UK sanctioned HTX in May, and the EU included it in a trading ban in July, which took effect on August 23, coinciding with the timing of the attack.

The Central Bank of Brazil has developed a real-time warning system for cryptocurrency threats and has collaborated with the digital asset threat protection company Hypernative to provide attack identification, response, and fund tracking support to banks and domestic cryptocurrency exchanges. In July 2025, cybercriminals exploited a software vulnerability in the financial software middleware company C&M to steal $180 million from the financial system and exchanged part of the funds for Bitcoin and USDT through exchanges.This incident has prompted the Central Bank of Brazil to accelerate the construction of related systems. Regina Pedroso, Executive Director of the Brazilian Tokenization Association, stated that the system will begin integration in the next two weeks, with Foxbit and Mercado Bitcoin participating in the implementation. Relevant agencies have completed testing and issued some warnings, and Brazil will also implement a 24-hour preventive hold on cryptocurrency transfers exceeding $10,000 per transaction or per day for individuals.

The security team of the open-source wallet provider OneKey successfully replicated the exploitation of a vulnerability in the old version of the Ledger Ethereum application in a laboratory environment. OneKey's founder and CEO Wang Yishi stated that they executed a "transaction replacement attack" on Ledger Ethereum application version 1.22.1 by exploiting a previously patched vulnerability, allowing attackers to overwrite pending transactions while users review legitimate transactions.Ledger responded that exploiting this vulnerability requires controlling the communication between the device and the host, such as through malware, compromised wallet software, or malicious web pages. Ledger has added application layer protections in the Ethereum application version 1.22.2 released on August 13 and fixed the underlying issue in Secure SDK 26.6.1 on August 21. Ledger emphasized that no users were hacked as a result; this was merely a replication of the vulnerability in a laboratory environment.This security test occurred after the Coldcard vulnerability incident. Previously, the Coldcard wallet had a firmware vulnerability that posed security risks to some mnemonic phrase generation, but Ledger stated that its devices were not affected by this vulnerability because recovery phrases are generated by a certified random source built into the device's secure chip. The vulnerability replicated by OneKey is unrelated to mnemonic phrase generation but affects the way transactions are processed during the signing process.

According to TenArmorAlert monitoring, the CCC token on the BSC chain was attacked, resulting in a loss of approximately $117,000.The attack exploited the contract's sell() function to destroy CCC tokens from the LP pool, causing abnormal price fluctuations.

On-chain analyst Specter revealed that a series of address poisoning attacks occurred on the Tron network over the past 4 weeks, resulting in a total loss of approximately $9.4 million for 15 victims. Among them, two victims had $2.5 million stolen each, while another lost $2 million.After the attackers succeeded, they quickly exchanged all the stolen assets for the stablecoin USDD and transferred them to a collection address, where all the funds remain. Specter urges Tron ecosystem wallet service providers to take interception measures as soon as possible and reminds users to carefully verify addresses when making transfers.

The Sandbox released an update on the security vulnerability attack incident involving the SAND cross-chain bridge, stating that the attacker modified the verification mechanism to forge cross-chain deposit messages and mint unbacked SAND. This incident resulted in approximately 14.7423 million SAND being withdrawn, valued at about $697,000. Additionally, some uncollateralized SAND was profited through market trading, leading to an overall economic impact of approximately $1.497 million, of which the attacker actually obtained about $987,000.The Sandbox stated that the attack did not affect the supply of SAND on Ethereum and Polygon, with the total amount of SAND on Ethereum remaining unchanged at 3 billion. There were also no super administrator privileges stolen, and the attack stemmed from a vulnerability caused by the combination of the general call function in the token contract and the design of bridge permissions. Currently, the related addresses have been marked, and collaboration has begun with exchanges, security agencies, and the LayerZero team.For affected users, The Sandbox promises to compensate wallets holding legitimate bridged SAND with a 1:1 ratio of SAND on the Ethereum chain based on an on-chain snapshot taken before the attack. The compensation application process is expected to open within two weeks and will last for two weeks.

According to monitoring by Blockaid, its vulnerability detection system has found suspicious activity on the Base chain related to Moonwell. Attackers manipulated the MAMO collateral price to borrow cbBTC from the mCBTC market.The currently observed impact is the transfer of 50.6 cbBTC (worth over 4 million USD).