Nobody Broke the Contract — They Just Asked It Nicely With the Right Permissions

The Grind Catch-Up: what you missed while we were offline. Part 7 of 8.

August’s losses came in around $136 million — well down from July’s $247M. But the month set a record for the number of incidents, and the character of them should worry you more than the total.

Almost none of them were contract bugs.

The Sandbox: permissions, not code

An attacker hijacked LayerZero delegate permissions via an approveAndCall function to mint unbacked SAND tokens. The Sandbox disabled bridging on Base and BNB Smart Chain in response.

Credit where due on disclosure: the team confirmed affected supply at under 0.01% of SAND’s 3 billion total. This was contained, and the honest number came out quickly.

But look at the mechanism. The contracts did what they were told. The problem was who was allowed to tell them — a cross-chain delegate permission that someone else ended up holding. That configuration lives outside the audited contract, often in a deployment script or a one-time setup transaction nobody re-reviews.

Harmony: 4 billion tokens from nowhere

Harmony ONE saw 4 billion unauthorized tokens minted. Again: a minting-authority failure, not a clever exploit of contract logic. Someone had the ability to mint who should not have, or a key that controlled it was compromised.

Coinsbuy: the plain old exchange hack

~$8 million taken from Coinsbuy in an exchange compromise. No DeFi involved at all. This is a corporate security incident that happens to involve crypto assets.

And Tectonic, $75M

Covered in full in Part 2 — oracle manipulation on a thin token, ending in Cronos rolling back its chain. Also not a contract bug. A risk parameter failure.

The through-line

Four significant incidents. Zero classic reentrancy-style contract exploits.

What actually failed: cross-chain permission configuration, minting authority, corporate/exchange security, and collateral risk parameters.

Every one of those sits in the gap between “the code was audited” and “the system is safe.” Audits scope to contracts. These failures live in deployment config, key custody, governance authority and parameter selection — the seams between components, which is exactly where nobody’s scope ends up covering.

Why This Matters for Crypto Jobs

There’s a job hiding in this pattern that barely has a name yet: somebody whose responsibility is the whole deployed system, not any single contract.

Skills that map directly to what failed in August:

• Cross-chain and bridge security — enumerate every delegate, owner and admin role across every chain you deploy to, and prove who holds them today
• Key management and authority mapping — who can mint, who can pause, who can upgrade, and what happens if any one of them is compromised
• Deployment and configuration review — treating setup transactions as security-critical artifacts, because they are
• Corporate/operational security — Coinsbuy and the Ledger data breach lawsuit are conventional infosec problems
• Risk parameter engineering — the Tectonic lane

If you’re already a smart contract auditor, the highest-value expansion is upward in scope: from “is this function safe” to “is this deployment safe, across all its chains, given who currently holds which keys.” Very few people can do that end to end, and every incident above needed exactly that person.

If you’re coming from traditional infosec — identity and access management, key management, incident response — you have been doing the relevant work all along. The industry is finally hiring for it.

---

Browse open security, infrastructure, and protocol roles at cryptogrind.com.