Issue #009 · Week of August 30, 2026

This Week’s Verdict

The theme this week is the gap between “patched” and “actually patched.” Cosmos Labs shipped a fix it believed closed the door, then watched six chains get drained through it, while Rain learned that a contract you forgot to update is a contract someone else will read for you. Bitcoin flirted with $81K, Warsh said the quiet part loud, and the ancient wallets started moving. None of it changes the arithmetic: shared code is shared risk, and the bill always arrives.

The Breaches

The headline event is the Cosmos EVM balance-handling flaw (GHSA-7g4w-cg88-2cq2), exploited between August 20 and 25 to drain roughly $5.7 million across six blockchains. MANTRA Chain absorbed the largest single loss at $3.6 million and disputes the timeline: it says the patch landed only 20 hours before the attack began and did not name the flaw it was quietly fixing. The bug shipped without a CVE, without a CWE classification, and without a CVSS score, which is a fitting epitaph for a vulnerability that maintainers believed they had already cleared. When you share a module across an ecosystem, you share the exploit too, and everyone patches on the slowest chain’s schedule.

Second on the ledger is the Rain card contract exploit on Solana, which Avici reports cost 1,685 users $500,859. The attacker used an outdated version of Rain’s contract that a small number of programs were still running. A related CoinDesk account puts the figure near $1.1 million and notes the issuing neobank’s token dropped 49% on the news. Both Rain and Avici say affected users will be made whole. Credit where due: the disclosure was clean and prompt, which the community noticed favorably against the muddier Metabase handling weeks prior.

Rounding out the drains, The Sandbox suffered a bridge exploit and pledged 1:1 SAND repayment from treasury using pre-incident balances on Base and BNB Chain, without inflating its fixed 3 billion supply cap. And Fogo, a Solana-adjacent Layer 1, halted mainnet after an attacker received 400 million FOGO (about 10% of circulating supply, worth roughly $3 million at the time). A halted chain is the modern circuit breaker: it works, and it tells you exactly how decentralized you weren’t.

Vulnerabilities Worth Your Attention

  • Polygon disclosed flaws fixed in recent hard forks carrying denial-of-service and validator resource risks. Patched before public disclosure, which is how it is supposed to go, and a quiet contrast to the Cosmos sequence.
  • Three CVSS 10.0 ServiceNow AI Platform flaws allow unauthenticated code injection, SQL injection, and privilege escalation. Hosted instances were patched; self-hosted and partner-managed instances are the exposure. Enterprise tooling remains the soft underbelly of every treasury operation.
  • GiveWP for WordPress carries a maximum-severity unauthenticated RCE, part of a broader batch of five critical WordPress plugin and theme flaws (Avada, TranslatePress, Pods, WPMU DEV Dashboard). Donation portals process crypto too.
  • Over 8,300 Gitea instances remain unpatched against a critical RCE already under active exploitation. Your CI pipeline is your supply chain.
  • ownCloud CVE-2023-49105 was added to CISA’s KEV catalog after a Chinese-speaking actor used it to hit a Philippine nuclear research body. A three-year-old bug still paying dividends.

Threat Actors & Campaigns

The drainer economy had a busy week in your browser. Researchers flagged 19 Chrome and Edge extensions (18 Chrome, 1 Edge) carrying wallet-secret theft and crypto-draining code, published over the prior six months and linked by shared tradecraft. A separate cluster delivered a modular malware framework deploying ClickFix lures alongside data theft. On the social-engineering front, Microsoft disclosed TerminalFix, a ClickFix variant that steers victims into Windows Terminal or PowerShell rather than the Run dialog, raising the odds that a complex command executes cleanly.

Session-token theft continues its quiet expansion beyond wallets: Anthropic warned that infostealers on user machines are lifting active Claude sessions to consume usage. It is the same primitive that drains exchange accounts, aimed at a new target. Meanwhile ShinyHunters claimed 284 million patient records from McKesson, FulcrumSec claimed 86 GB from Manchester Airports Group, and Berlin confirmed it will not pay its extortionists. The pattern holds: infostealer, session, extortion, repeat.

Then there is the crypto grift proper. Real Trump Coins denies authorizing the GOLD token that crashed roughly 99% after team-linked wallets dumped 224.5 million tokens in a suspected $330,000 rug, blaming “bad actors” while questions swirl around its X account and concentrated supply. Also worth a skeptical glance: upvote.trade, a Robinhood Chain “reward for old MOON holders” scheme routing through tokenized RDDT with a wallet checker and nothing claimable. Wallet checkers are reconnaissance. Treat them accordingly.

The Bigger Picture

Markets got their Jackson Hole cold shower. Fed Chair Kevin Warsh told the room the central bank has “work to do” on inflation and offered zero rate hints, sending Bitcoin from an overnight $81,479 high back below $78,000, and ending a nine-day spot Bitcoin ETF inflow streak with $201.8 million in outflows. Ethereum ETFs, by contrast, pulled $226 million in a day. Michael Saylor teased Strategy’s first purchase in two months. And Bitcoin’s oldest coins keep waking: Galaxy Research notes six ancient wallets moved $40 million in ten days, most avoiding exchanges, which is the opposite of a distribution signal, for now.

On the board that actually matters, regulation split cleanly. The Ninth Circuit ruled Kalshi’s sports contracts are gambling Nevada can regulate, directly contradicting the Third Circuit and setting up a SCOTUS collision. The lesson generalizes: courts weigh what a product does, not what the filing calls it, and that reasoning points straight at every “it’s just software” defense onchain. The Clarity Act slipped to September; banks are building anyway. California’s Senate passed a bill banning memecoin issuance by public officials, arriving too late for the $4.7 billion that Public Citizen says investors are underwater across Trump ventures.

Adoption kept its ste

Resources

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.