Crypto hacks hit 2026 record with 50 incidents in August as losses fall to $136 million

Crypto hacks hit their highest monthly count of 2026 in August, with 50 major incidents recorded even as total losses fell 49.5% to $136.3 million, according to blockchain security firm PeckShield.

The decline from July’s roughly $270 million came despite a 67% jump in attack frequency, driven largely by a $74 million exploit of Cronos-based lending protocol Tectonic that was contained before most of the funds could move.

Crypto hacks rise as August losses fall

PeckShield’s August data shows that crypto hacks became more frequent even though aggregate losses declined. The 50 incidents recorded during the month represented a 67% increase from the 30 attacks reported in July.

Tectonicfi was responsible for the largest share of the damage. The roughly $74 million exploit represented about 54% of August’s total losses. Yet the attack did not result in the full amount being successfully moved by the exploiter.

Only about $6 million was bridged out before Cronos paused its chain. That action left most of the stolen assets trapped, significantly reducing the financial impact of the breach compared with the initial amount targeted.

The remaining $62.3 million in losses was spread across numerous smaller incidents. Among the protocols affected were Termlabs, which lost $8.5 million; Moonwell, with $8.7 million in losses; Coinsbuy, at $7.9 million; and TAC, which recorded approximately $7.5 million.

PeckShield’s findings also point to changes in the distribution of attacks. While the number of exceptionally large exploits declined compared with July, attackers increasingly targeted mid-tier protocols and components within decentralized finance.

For security specialists, the figures also underscore a recurring weakness behind many crypto hacks: privileged credentials that can provide extensive control when a single private key is compromised.

AEREDIUM targets single-key exposure

AEREDIUM’s response is centered on AERSeal, a newly announced product built around its threshold-key infrastructure. Rather than allowing one private key to control sensitive smart-contract functions, the system distributes signing authority among multiple authorized approvers.

Smart contracts can contain powerful administrative permissions, including the ability to mint assets, upgrade contracts or execute other privileged functions. If those permissions are controlled by a single private key, theft or compromise of that key can potentially give an attacker broad control.

AERSeal is designed to replace that model with threshold signing. Key shares are held separately inside hardware-attested enclaves and are not reconstructed into a complete private key. Instead, signatures are generated using the CGGMP24 threshold-signing protocol.

The approach is intended to make a successful compromise of one device insufficient to obtain complete control.

“AERSeal is the first complete product to put AERKey into operation from end to end,”  Albert Dadon, founder and CEO of AEREDIUM.

“The goal is to remove the idea that control over an entire smart contract should depend on one private key. With threshold signing and defined approval policies, control can be distributed and independently verified rather than concentrated in a single point.”  Albert Dadon, founder and CEO of AEREDIUM.

The product currently supports Ethereum Virtual Machine and EVM-compatible chains. Its activation process begins by identifying the privileged powers associated with a customer’s smart contract and transferring those permissions to the threshold key.

AERSeal then verifies on-chain that the transfer has been completed. Customers can also independently verify the threshold key assigned to them.

Hardware-attested governance seeks to limit crypto hacks

The architecture is intended to address a vulnerability that can make crypto hacks especially damaging: the concentration of administrative authority on a device or endpoint that can be compromised.

According to the supplied account, AERSeal uses address derivation and a signed fresh challenge to allow customers to verify key derivation and possession, including through offline verification. The onboarding process includes know-your-customer verification, contract registration, cryptographic key verification, transfer of privileged powers, on-chain verification and activation of an approval policy.

The security model also separates proposing an action from approving it. A compromised laptop, for example, would provide no more than one signatory position, while API tokens can propose transactions but cannot approve them.

Hardware-attested enclaves are added to the signing group only after fresh attestations have been verified against a distributed trust list. The mechanism is designed to protect against unauthorized hardware configurations and replay attacks.

Dadon said the architecture is aimed at the underlying weaknesses identified in security reports, particularly where privileged keys exist in complete form on machines vulnerable to phishing or other forms of compromise.

The broader challenge remains significant. As decentralized finance platforms and other blockchain applications continue to manage valuable assets through smart contracts, attackers have continued to probe both technical infrastructure and access controls.

The August figures show that crypto hacks remain a persistent threat even when aggregate losses fall. More incidents do not necessarily translate into higher monthly losses, as demonstrated by the containment of much of the Tectonicfi haul.

For projects managing privileged smart-contract functions, the focus is therefore shifting beyond simply protecting a single secret. Threshold-based signing, distributed authorization and hardware verification represent an alternative approach intended to reduce the consequences of a compromised endpoint.

Whether such systems can materially reduce future crypto hacks will depend on their adoption, implementation and ability to withstand evolving attack techniques. But the August figures provide another indication that controlling privileged access remains central to blockchain security.

The experience of Tectonicfi also illustrates the importance of response mechanisms. While the initial exploit was responsible for roughly $74 million in losses, the Cronos intervention prevented most of those assets from being moved, demonstrating how network-level action can affect the final financial consequences of crypto hacks.

As the industry evaluates new security architectures, the central issue is increasingly how authority is distributed, and whether compromising one machine, credential or individual is enough to take control of an entire smart contract.