Web3 Daily Exploits - August 22, 2026

In the last 24 hours the dominant theme was cross-chain messaging and permission primitives failing under real economic pressure: a repeated LayerZero OFT delegate takeover on Sandbox printed massive unbacked supply while only modest real value left the adapter, BounceBit chose full chain retirement over patching an authorization bug, and classic social-engineering address poisoning still extracts millions. Operational security and adapter design remain the highest-ROI attack surfaces.

1. The Sandbox – LayerZero OFT Delegate Hijack via approveAndCall (Base + BSC)

Impact (confirmed / estimated):

• Unbacked SAND minted on Base: reports range from 14.9 billion (PeckShield primary addresses) to 329.24 trillion across 703 mint events to 173 addresses over ~5 hours (23:42 UTC Aug 21 → 04:45 UTC Aug 22). Face-value estimates reached ~$49 billion.
• Real economic loss: ~14.75 million SAND drained from the Ethereum OFT adapter (same contract address as the Base OFT), netting the attacker roughly $665k. Ethereum L1 totalSupply remained untouched at 3 000 000 000.
• Official statement: impact < 0.01 % of total supply; bridges to/from Base and BSC disabled; tokens on those chains isolated; compensation plan for affected LPs forthcoming.

Technical root cause:
The OFT contract exposes a generic approveAndCall(target, amount, data) primitive. The attacker called it with data encoding setDelegate(attacker). Because the first argument to setDelegate is the caller and the OFT itself becomes msg.sender when it invokes the Endpoint, the LayerZero OApp delegate role (normally onlyOwner-gated) was hijacked. Subsequent permissionless calls (setConfig, verify, commitVerification, lzReceive) allowed forged messages that triggered unrestricted _mint / _credit on the destination. No flash loan required; everything executed in ordinary transactions. This is the third documented LayerZero OFT delegate hijack of 2026 (after KelpDAO and StakeDAO).

Key addresses & explorers:

• Exploiter (Base): 0x638Ccb18370eE228378a565c1d4D0F9620d7F296
• Primary mint recipients flagged by PeckShield: 0xAbE0…4D22 and the address above.
• OFT / Adapter: 0xac531Eb26Ca1d21b85126De8FB87E80E09002DcF (Base) / same address on Ethereum.
• Example exploit tx: 0x76ed03844ff61520a0fb99278f92f2f1453b24ccbacd20b91131703e4a56a446

X references:

• PeckShieldAlert initial alert:
• Official Sandbox containment statement:
• Detailed on-chain timeline (BlockWatchdog / DBCrypto threads circulating): see quoted posts under the PeckShield alert.

Bridges remain paused; users are warned not to trade SAND on Base or BSC.

2. BounceBit – Permanent L1 Sunset After Evmos Authorization Flaw (~$3 M)

Timeline: Unauthorized transfers ran 21:02 UTC 19 Aug → 01:54 UTC 20 Aug (14 txs, ~4 h 52 min). Network halted at block 20 702 857. Decision to permanently retire the chain announced and reiterated in the last 24 h.

Technical details:
Flaw in an Evmos-stack module (vesting / lockup account handling). A caller could specify an arbitrary account as the funding source; the authorization check that should have verified the funder’s approval never fired correctly. No private keys, signatures or wallets were compromised. ~286.5 million BB (~$3–3.1 M, ~23 % of circulating supply at the time) moved from nine ordinary balance-holding accounts.

Remediation:
Pre-attack snapshot at block 20 697 260 (19 Aug 21:02:35 UTC). Unauthorized transfers cancelled. BB re-issued as BEP-20 on BNB Chain; matching addresses (including staked / unbonding positions) receive the new token automatically. CeDeFi products, vaults and RWA offerings were unaffected.

X / source links:

• BounceBit official update thread and article references circulating on X (e.g. https://x.com/bouncebit status updates).
• Secondary coverage: The Block, Crowdfund Insider, etc.

This is a rare case of a team choosing full chain retirement over continued operation after a protocol-level authorization bug.

3. Bofur Capital – $2 M Address-Poisoning After Compound Withdrawal

Classic social-engineering drain. After a Compound withdrawal the victim’s transaction history was polluted with a 0.0002 USDC dust transfer from a look-alike address. The subsequent large transfer was copy-pasted to the poisoned address. Funds converted to ~2 M DAI and parked at 0xe2eB…1816a.

No smart-contract vulnerability; pure UX / operational failure around truncated-address verification and recent-history trust.

X reference: PeckShieldAlert

4. MANTRA Chain – Cosmos-EVM Upstream Dependency Incident (Halt & Recovery)

Network frozen late 20 Aug after an attacker exploited a vulnerability in an upstream dependency inside the Cosmos EVM module. Two MANTRA-managed wallets were affected; team stated no user, exchange or partner funds were taken. Validators kept offline while v8.4.0 was tested on DuKong testnet. Block production resumed ~05:30 UTC 22 Aug. Full post-mortem promised.

Token briefly hit an all-time low during the outage. Status updates tracked on the project’s X account and status page.

5. Other Notable Items (Last 24–48 h Window)

• Maya Protocol remains halted post-18/19 Aug exploit (chained withdrawal-logic flaws). Attacker-linked wallet still holds 20.83 BTC (~$1.36–1.7 M direct extraction, broader pool impact ~$10.9 M). Deposits on multiple chains still suspended.
• Allbridge (Aug 19, $190 k): SlowMist published full analysis of a month-long CCTP message-forgery + missing sender/recipient checks attack that used a flash-loan top-up of the router. Circle attestation alone was treated as sufficient for credit.
• DefimonAlerts white-hat rescue: On-chain message clarifying a rescue bot address vs the true exploit tx 0xf4ea3fb662c23aec4155db32f2c3fdddcebd07adcbc5cb782a8b0388618a7d4b and subsequent return tx 0x893731fb073cacd5df96fb7a6fb391622c396ca63e2719c92882623468a26b42.
• Rust supply-chain alert (SlowMist): Compromised crates (arrayref@0.3.10 et al.) introducing malicious proc-macro1; relevant to Solana ecosystem dependency graphs. Exact pinning and rebuilds recommended.

Monitored accounts (DefimonAlerts, CertiKAlert, Phalcon_xyz): DefimonAlerts posted the white-hat clarification; the other two accounts had no high-signal public alerts in the exact 24 h window covered by the keyword searches performed for this report.

Editorial note: Cross-chain messaging layers (LayerZero OFT, CCTP, Cosmos-EVM bridges) and authorization primitives continue to dominate loss events. The pattern of “massive nominal mint, modest real extraction” is becoming common once an adapter or delegate is compromised. Address poisoning remains trivially effective against even sophisticated desks. Teams that choose permanent chain retirement (BounceBit) or rapid full-network halt + patch (MANTRA) illustrate the spectrum of containment strategies currently in use.

All figures and addresses are taken from on-chain explorers, official project statements and primary security-firm alerts as of ~14:00 UTC 22 Aug 2026. Further post-mortems are expected. Stay safe; verify full addresses and never trust truncated history.