August's exploit wave barely involved code bugs. Hijacked bridge permissions, unauthorized minting, a compromised exchange. The attack surface moved to config, and almost nobody is auditing config.
Cronos didn't negotiate with the attacker who took $75M from Tectonic. It rewound the entire chain — and deleted every unrelated transaction from the last two hours along with the theft.
A governance attack on BonkDAO drained $20M in BONK tokens from the Solana DAO's treasury using the project's own voting system. No smart contract hack required.
Chaos Labs is walking away from Aave after 3 years and 'zero material bad debt.' They're the third core contributor to quit since March. No one knows who's watching the money.