August 2026 logged 50 major crypto hacks, the highest monthly count of the year, but total losses fell to $136.3 million — a 49.5% drop from July's $270 million. The month's biggest single hit was a $74 million exploit of the Tectonic lending protocol on Cronos, the fourth-largest crypto theft of 2026.
Tectonic and the Cronos freeze
The Tectonic attacker moved only about $6 million to Ethereum before Cronos validators froze the network. They later started laundering funds by bridging to Bitcoin, with roughly $200,000 moved so far. Cronos restored its chain state to a point before the attack and resumed block production.
The freeze was blunt but effective. It stopped the bleeding early, and the chain's rollback meant the bulk of the stolen funds never left the ecosystem.
Why the dollar figure fell
The average loss per hack in August dropped to about $2.7 million, down from roughly $9 million in July. That's a sharp swing, and it explains how a record number of incidents can still produce a smaller total.
The top ten August incidents accounted for $123.34 million, leaving about $12.9 million spread across the other 40 hacks. In other words, most of the month's damage came from a handful of events, and none of them approached the scale of April's Drift and KelpDAO exploits, which together drove that month to $646.89 million — still the costliest of 2026.
The rest of the top ten
Other notable August hacks include Moonwell ($8.7M), Term Labs ($8.5M), Coinsbuy ($7.9M), and TAC ($7.5M). Injective, MANTRA, BounceBit, Cosmos Labs, and aquifer rounded out the top ten.
The spread of targets — lending protocols, bridges, exchanges, and infrastructure projects — suggests attackers are casting a wide net rather than concentrating on one type of platform. The lower average loss may reflect better defenses at the biggest targets, or simply luck.
What's less clear is whether the freeze-and-rollback playbook used on Cronos will become a template. It worked there, but it's a heavy tool that requires validators to act fast and coordinate. Not every chain can pull it off.
