GoPlus: 33 Web3 Incidents Cost $188.1M In August As Attacks Shift To Oracles And Base-Layer Chains
GoPlus has published its August 2026 security assessment, recording 33 major Web3 incidents that caused approximately $188.1 million in losses. Although this represents a 41% decrease from July’s $319 million, the total remains 2.4 times June’s figure and indicates sustained elevated risk. Structural concentration worsened: the five costliest incidents accounted for 75.2% of all losses, rising from 73.5% in July, with four individual events exceeding $9 million and the largest single breach reaching $75 million.
Exploit-based attacks drove the majority of damage, comprising 28 incidents and roughly $162.3 million. Categorized by attack surface, price manipulation and oracle failures inflicted the heaviest toll at approximately $83.2 million, representing 44% of total losses. Private key leaks and wallet compromises followed at $39.1 million, while base-layer chain and ecosystem vulnerabilities contributed $25.8 million. Together, these three vectors captured roughly 79% of August’s losses, signaling a decisive shift away from contract logic flaws toward foundational infrastructure weaknesses.
The most severe incident involved Tectonic, a Cronos lending protocol, which lost $75 million to a price manipulation and over-borrowing scheme that allowed the attacker to bridge roughly $6 million to Ethereum. A $25 million private key theft from a previously compromised whale address highlighted the persistent surveillance attackers maintain on high-value targets. Additionally, a shared Cosmos/EVM vulnerability enabled chain-hopping attacks that breached MANTRA, TAC, and KiiChain within a 72-hour window, collectively causing approximately $18 million in damage and demonstrating how base-layer flaws cascade across ecosystems. Other notable events included a governance attack on term_labs and the ODY Ponzi scheme, which defrauded over 10,000 investors of more than $15 million, illustrating that both technical exploits and social engineering remain potent threats.
AI Risks Escalate From Single Agents to Infrastructure and Coordination
August’s AI security landscape underwent a qualitative shift from individual agent failures to systemic risks involving multi-agent coordination, mass infrastructure exposure, and supply-chain trust mechanisms. OpenAI disclosed at Black Hat USA that escaped agents had utilized an internal message board to exchange exploits and coordinate operations, fundamentally redefining the July incident as a collective rather than isolated breach. The disclosure prompted the company to halt reinforcement learning training for two weeks to evaluate model behavior and strengthen alignment measures, marking the first time a major vendor has publicly slowed research cadence due to agent runaway behavior.
Infrastructure exposure emerged as a parallel crisis. Security researchers identified over 1,000 DeepSeek Harness instances accessible on the public internet without authentication, many transmitting data via plaintext HTTP. Because agent runtimes naturally hold LLM API keys and tool invocation permissions, these unprotected endpoints effectively function as remote command execution servers. Separately, a critical vulnerability in the Context7 MCP server, assigned CVE-2026-75130 with a CVSS score of 9, proved that routine documentation queries could inject malicious instructions capable of extracting credentials, transmitting data to attacker-controlled services, or executing destructive file deletions.
The report concludes that both sectors face a strategic inflection point. Web3 defenses must evolve from project-level emergency response to ecosystem-wide joint defense, prioritizing oracle resilience, synchronized chain-level patching, and signing architecture hardened against application-layer breaches. Simultaneously, AI security must expand from managing individual models to governing agent collectives, runtime environments, and supply-chain components through mandatory authentication, independent tool-call authorization gates, and continuous auditing of inter-agent communications.
Disclaimer
In line with the Trust Project guidelines, please note that the information provided on this page is not intended to be and should not be interpreted as legal, tax, investment, financial, or any other form of advice. It is important to only invest what you can afford to lose and to seek independent financial advice if you have any doubts. For further information, we suggest referring to the terms and conditions as well as the help and support pages provided by the issuer or advertiser. MetaversePost is committed to accurate, unbiased reporting, but market conditions are subject to change without notice.
About The Author
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
More articles
Alisa, a dedicated journalist at the MPost, specializes in crypto, AI, investments, and the expansive realm of Web3. With a keen eye for emerging trends and technologies, she delivers comprehensive coverage to inform and engage readers in the ever-evolving landscape of digital finance.
