Web3 Attack Surfaces: A Penetration Testing Overview

Crypto institutions keep every traditional attack surface and add the money-handling chain on top of it. This article gives testers a practical abstraction of the running system: a four-component model—Application, Authorization and Signing, Blockchain Interaction, and Infrastructure—with each component's responsibility, representative implementations, and inherited attack surfaces. It then structures web3-specific coverage into five attack-surface areas, from production and automation operations through signing intent, approval and withdrawal chains, and fund logic to on-chain transactions and deployed contracts.

~$23M Lost: Cosmos EVM, Moonwell Exploits | BlockSec Weekly

During the reporting period (2026/08/22 - 2026/08/30), we cover 5 blockchain security incidents totaling approximately $22.7M in losses; an estimated $74M-$119.5M was drained from Tectonic, most of it erased when Cronos was rolled back to its pre-exploit state. The highlight is a six-chain Cosmos EVM exploit series (~$5.7M realized), traced on TAC Chain, where a shared balance-synchronization bug chained an underflow and an overflow to drain a staking pool. The report also analyzes Moonwell's combined collateral-accounting and oracle price manipulation, Tectonic's combined oracle-price and receipt-token exchange-rate manipulation of low-liquidity collateral, an Ajna liquidation business-logic flaw, and a Rain Card Contract Exploit Series with an Ed25519 signature-verification bypass (Avici, Tria, and others) on Solana.

Rules of Engagement and Production Safety for Institutional Blockchain Penetration Testing

A penetration test that touches signing, withdrawal, and ledger systems is prepared before it runs. This article follows the engagement lifecycle: turning a business decision into objective, scope, named owners, and authorized access; recording authority, permitted techniques, operating limits, prohibited activity, communications, and evidence handling in a Rules of Engagement document; and protecting live service with measurable stop criteria, monitoring, change coordination, and named pause authority. It closes with the remediation and retest that turn findings into validated controls.

What Is Blockchain Penetration Testing? Definitions and Boundaries

No widely accepted definition of blockchain penetration testing exists, and many proposed ones tangle it with audit, scanning, and bug bounty. This article sets out a working definition—an adversarial, hands-on assessment of a running system, under agreed scope and rules of engagement, that validates exploitable paths and control chains—and what web3 adds: a money-handling threat model whose defining composition gap is the off-chain-to-on-chain handoff. It then maps the five testable capabilities of that chain and routes nearby objectives to code audit, wallet security audit, web3 security testing, scanning, and bug bounty.

From Incidents to Regulation: Why Crypto Institutions Need Blockchain Penetration Testing

Exchanges, payment firms, custodians, and wallet providers now lose the most money beyond the smart contract—in signing, custody, keys, people, and supply chains. Code-level audit and transaction-level monitoring each leave a gap, and traditional penetration tests may miss crypto's signing and fund semantics. This article opens our blockchain penetration testing series with the two legs of the case for institutions in scope: where the risk actually comes from, and how NYDFS, DORA, VARA, SFC, and MAS treat adversarial testing across five jurisdictions.

Newsletter - August 2026

During August 2026, three major DeFi security incidents caused significant losses. A balance-synchronization vulnerability in the Cosmos EVM module was exploited across six chains (~$14.8M). Moonwell on Base lost ~$9.1M to oracle price manipulation targeting the low-liquidity MAMO token. Term Finance on Ethereum suffered a ~$8.47M governance takeover enabled by near-zero voter participation.

Fun Coffee Scam: Tracing a 278% Ponzi on TRON

Fun Coffee promised 278% a year, then went dark. We traced 72.8M USDT across 99 TRON addresses.

~$10.26M Lost: Term Finance, MAYAChain | BlockSec Weekly

During the week of August 17-23, 2026, two notable security incidents resulted in approximately $10.26M in total losses across Ethereum and MAYAChain. The highlighted Term Finance incident (~$8.5M) was a flawed governance design rather than a coding bug: each vault ships its own on-chain DAO whose support-threshold and participation checks are purely relative, with no absolute floor; with almost no one taking part in governance, there was no electorate to vote a proposal down and no guardian to cancel one, so an attacker acquired a supermajority of a vault's voting power for roughly 0.5 ETH and, after the execution delay elapsed, drained six of Term's vaults for approximately $8.5M in total. MAYAChain (~$1.76M) lost funds to a chain of accounting and state-validation defects, where a single crafted deposit made valid withdrawals appear to have failed, triggered a recovery path that inflated a low-liquidity pool's recorded native-token balance with no real backing, and let the attacker drain the inflated value by adding and withdrawing liquidity.

Harmony Cross-Shard ONE Mint + ~$47M Key Losses | BlockSec Weekly

During the week of August 10-16, 2026, 5 notable security incidents are featured, involving approximately $47M in quantified losses, with the detailed analysis focused on a chain-implementation flaw in the Harmony Layer-1. Harmony suffered unauthorized minting of native ONE through a cross-shard receipt replay: destination shards derived the receipt spent-marker from unauthenticated MerkleProof.ShardID and BlockNum fields instead of the signed source header, so an already-credited receipt could be replayed with no matching source-shard debit. Approximately 3.01T ONE was forged, but its nominal value far exceeds the token's market capitalization and is neither realizable nor confirmed realized loss, so Harmony is excluded from the total; the ~$47M came from private-key compromises (Unknown Whale Wallet ~$25M, Kite ~$14M, and Coinsbuy ~$7.9M) plus a Fox business-logic flaw (~$117K).

HKDAP Stablecoin Security Review: Live, Licensed, Not Ready

BlockSec's review of HKDAP, Hong Kong's first regulated stablecoin, finds non-functional KYC revocation, single-key mint authority, and clashes with the HKMA guideline.

~$1.6M Lost: Moke Token, LpdFi Exploits | BlockSec Weekly

During the week of August 3-9, 2026, 2 notable security incidents on BNB Chain resulted in approximately $1.6M in total losses, both from price manipulation. The highlighted LpdFi incident (~$697K) reused the same manipulable PancakeSwap pair reserves for both order valuation and interest redemption, letting the attacker inflate a position's principal and reshape the pool to redeem an oversized interest claim. Moke Token (~$906K) combined a manipulable spot price with duplicated LP dividend accounting to claim inflated MOKE and collect the resulting BNB dividends multiple times.

COLDCARD Incident: When a Wallet's "Random" Seed Wasn't Random

A silent build-and-integration bug in COLDCARD firmware routed Bitcoin seed generation onto a software RNG fallback, whose weak randomness left wallet seeds recoverable offline. Because the weakness is in the seed itself, a firmware update cannot undo it; verified sweeps reached 1,405 BTC (~$91M) by 7 August 2026, with private-channel estimates as high as 2,055 BTC.