web3

Web3 Daily Exploits — August 20, 2026

Technical incident report from the last 24 hours

Jacobo Avariento

— 3 min read
Share
Web3 Daily Exploits — August 20, 2026

1. Maya Protocol (~$1.7M) — Six-bug accounting inflation (August 18–19)

Maya Protocol (MAYAChain), a THORChain-style cross-chain liquidity network, was exploited for approximately $1.7 million. The attacker extracted ~48.87 million CACAO and 98.82 LINK from shared liquidity, then swapped a large portion into Bitcoin and other assets. CACAO crashed roughly 89% in the process; total pool-value impact was estimated near $11 million when including secondary effects. The network was halted.

Technical root cause:
A single 23-message MsgDeposit transaction chained six bugs. It triggered a false “theft” detection on an outbound transfer, which activated an uncapped slash-subsidy mechanism. This incorrectly credited a low-liquidity ARB.LINK pool with ~49.45 million CACAO even though the protocol reserve held only ~168k CACAO (the funding transfer failed, but the inflated balance remained on the books). The attacker then added a negligible amount of liquidity, obtained 99.93% ownership of the distorted pool, and withdrew the inflated balance.

Subscribe

On-chain references:

X references:

  • CertiK Alert breakdown:
  • Founder acknowledgment (@AaluxxMyth):
  • Protocol update:

The team has stated it is working on a full recovery and fix before resuming swaps.

2. Allbridge CCTP Router on Base — $191K Phantom Deposit (August 19)

Allbridge’s new CCTP router on Base was drained of 191,156 USDC. The attacker forged a Circle message months earlier, waited for a real deposit to land, then redeemed the phantom message.

Technical root cause:
CCTPTokenMessenger.receiveCctpMessage credited the amount declared inside a Circle-attested message without verifying that USDC had actually been minted or burned on the destination chain. Circle’s MessageTransmitterV2.sendMessage attests arbitrary payloads with no attached burn/mint requirement. The attacker therefore:

  1. On July 25 forged a message on Polygon claiming a 1,000,000 USDC deposit (no real funds moved).
  2. On August 19, six seconds after a legitimate ~191k USDC CCTP transfer arrived, executed the exploit.
  3. Flash-loaned the shortfall (~808,844 USDC) from Aave to temporarily top up the router balance.
  4. Called the router’s receive path, received ~999k USDC payout, repaid the loan + premium, and netted ~189,752 USDC.

Copycat transactions later cleaned residual dust. The owner subsequently deregistered the messenger.

Key addresses & transaction (Base):

X / Defimon reference:


Full write-up: https://defimon.xyz/blog/allbridge-hack-august-2026

3. Tornado Cash Domain Phishing — 1,010 ETH (~$2.3M)

A user lost 1,010 ETH after following an outdated bookmark to the expired tornado.cash domain. The domain had lapsed (team unable to renew under OFAC sanctions) and was registered by attackers who stood up a fake frontend. Deposits went to the real Tornado Cash contracts, but the malicious site captured the private notes required for withdrawal. Funds were drained within ~12 hours. The same operation is alleged to have taken nearly 4,000 ETH over the past year via similar residual-domain tactics.

This is not a smart-contract vulnerability but a classic infrastructure / user-hygiene failure. Always use verified IPFS or ENS gateways for privacy tools whose original domains may have lapsed.

X references (community reports):

  • Wu Blockchain:
  • Related tracking discussion circulating widely on August 20.

Other notes from the monitoring accounts

  • DefimonAlerts also flagged an unauthorized mint of ~1 billion MemeCore tokens via a cross-chain bridge with no corresponding lock/burn on the source chain (tokens remained unmoved at time of report).
  • A white-hat disclosure was posted regarding medium-severity issues in a RangeVaultArbCompoundV5 factory on Arbitrum (manipulable slot0 tick + operator-supplied slippage).
  • Phalcon / BlockSec published its weekly roundup covering the prior week (~$47M lost across five notable incidents); no brand-new major protocol exploit was highlighted by them in the strict last-24h window beyond the items above.

Takeaways for builders:
Attestation without state verification (Allbridge) and uncapped internal subsidy / accounting paths (Maya) remain high-risk patterns in cross-chain designs. For users, expired domains and old bookmarks continue to be low-effort, high-impact vectors. Always re-verify official interfaces and prefer on-chain or IPFS sources.

Stay vigilant. More details will be updated as post-mortems land.

Subscribe

Read more