Decentralized finance (DeFi) vault infrastructure protocol More Markets had a lending reserve drained of about $9.3 million in digital assets on Flow EVM, according to Web3 security platform Blockaid.

The attacker drained about 15.5 million Wrapped Flow (WFLOW) tokens, valued by Blockaid at approximately $9.3 million, from the mFlowWFLOW lending reserve, according to blockchain data shared by Blockaid in a Monday X post.

Blockaid said the attacker used Ankr Staked FLOW (ankrFLOW), a liquid staking token, alongside E-mode to overborrow from the reserve.

E-mode, short for efficiency mode, is an Aave V3 feature that increases borrowing power for assets whose prices are expected to move together, such as a liquid staking token and its underlying asset.

The exploit pushed total losses from cryptocurrency hacks to $139.7 million for August, making it the third-largest month by value stolen so far in 2026. However, it marks a significant decrease from $254 million stolen during July, according to DefiLlama data.

On Sunday, Cronos halted its blockchain network after a reported $75 million exploit targeting DeFi lending protocol Tectonic.

More Markets had not publicly confirmed the incident or disclosed whether users suffered losses at the time of publication. Cointelegraph contacted Blockaid for more details but did not receive a response by publication and was unable to reach More Markets for comment.

Related: Humanity Protocol to prioritize operational security following $36M hack

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Ripple recorded another round of RLUSD treasury activity on Aug. 31, including an 11 million-token mint and a separate 11 million-token burn.

The transactions were reported by the Ripple Stablecoin Tracker. They followed several large operations on the XRP Ledger and Ethereum during the final days of August.

CoinGecko placed RLUSD’s circulating supply and market capitalization at approximately $2.37 billion on Aug. 31. The stablecoin continued trading close to its intended $1 peg, meaning supply growth rather than price appreciation drove the higher valuation.

Advertisement

RLUSD minting does not necessarily show net demand

A stablecoin mint creates tokens at an issuer-controlled address. Those tokens may remain in treasury, move to an institutional customer or support transfers between networks.

A mint therefore does not prove that an equivalent amount entered public circulation. Likewise, a burn removes tokens from supply and can accompany customer redemptions, treasury management or network rebalancing.

The matching 11 million-token mint and burn on Aug. 31 illustrate that distinction. Viewed separately, the mint suggests expansion. Considered together, the two transactions produced no net increase from those specific operations.

Advertisement

Ripple did not identify the customer, purpose or economic relationship behind either transaction. The ledger records establish that the transactions occurred, but they do not establish new institutional demand.

As crypto.news previously reported, Ripple minted another 10 million RLUSD on XRPL on Aug. 17. Ripple also did not disclose the receiving customer or intended use of that issuance.

RLUSD supply moved above $2 billion in August

RLUSD crossed $2 billion in market capitalization during August, less than two years after its December 2024 launch. Ripple confirmed the milestone on Aug. 25 and said close to $1 billion had been issued on the XRP Ledger.

In related coverage, RLUSD approached an even split between XRPL and Ethereum when it crossed the threshold. Ethereum held a modestly larger amount at that time.

Advertisement

Available data now show continued supply expansion. CoinGecko reported approximately 2.37 billion circulating tokens on Aug. 31. XRP Ledger trackers placed the network’s portion above 1 billion tokens after several late-August mints.

Ethereum remains another major venue for RLUSD. Ripple has also extended the stablecoin to Base, Ink, Optimism, Unichain and the XRPL EVM sidechain. Public dashboards do not always provide synchronized supply totals for every network, which can produce differences between data providers.

Ripple’s reserve report trails the latest mints

Ripple’s transparency page reported $1.866 billion in circulating RLUSD and $1.981 billion in reserve funds as of Aug. 20. That official snapshot predates the latest issuance and the $2 billion milestone.

Standard Custody & Trust Company, a Ripple subsidiary supervised by the New York State Department of Financial Services, issues RLUSD. Ripple says reserves consist of cash and permitted cash equivalents held in segregated accounts.

Advertisement

Deloitte prepares monthly attestations covering the reported circulation and reserve balances. However, those reports are retrospective. They do not provide real-time confirmation of reserve changes after every mint or burn.

The next attestation should offer a clearer view of whether reserve assets increased alongside the late-August supply expansion.

What happens next for RLUSD

Further treasury transactions will show whether the latest mints move into circulation or are offset by additional burns. Transfers from treasury accounts to exchanges, custodians or institutional counterparties could provide more context, although wallet movements alone may not reveal their purpose.

The next reserve report will be the more important disclosure. It should show whether Ripple maintained reserve assets above circulating liabilities as RLUSD moved beyond $2 billion.

Advertisement

No verified XRP price movement could be directly attributed to the RLUSD transactions. RLUSD growth may add dollar liquidity to the XRP Ledger, but it does not automatically create equivalent demand for XRP.

Alphabet just had a genuinely turbulent month, and the whiplash tells its own story. Despite beating earnings expectations with profits of $9.11 per share, roughly triple what analysts had forecast, the stock actually sold off in the days following the report, weighed down by mounting concerns over AI spending. That mood shifted decisively on Monday, when shares jumped over 5% after Morgan Stanley reassured investors, highlighting Alphabet’s still-robust $53.3 billion in free cash flow over the past twelve months, even as cloud capital expenditure could exceed $1.2 trillion in 2027.

The underlying business remains genuinely strong: Google Cloud revenue surged 82% year-over-year to $24.8 billion in Q2, and the company has been actively defending its position, launching more budget-friendly AI pricing to compete directly with rivals. That said, not everything has gone smoothly. Alphabet agreed to pay £260 million to settle a UK class-action lawsuit this week, and a leadership shakeup within its AI division, including the departure of key figures, has added a layer of organizational uncertainty investors are still digesting.

The result: a company delivering genuinely impressive growth, but one whose massive AI bet keeps testing investors’ patience with every headline.

Technical Analysis of Alphabet (GOOGL)

As the GOOGL chart shows, the stock has been compressing into a symmetrical triangle since April, with a descending trendline from the 400 highs converging with an ascending trendline off the 269 low, both meeting right at the current price near 340–346, exactly where the 0.5 Fibonacci retracement and the 200-period EMA also sit.

Bullish Scenario

Should buyers defend this trendline-EMA confluence and break decisively above the descending trendline, the path would open toward the 0.382 retracement near 356.79, with a stronger move potentially targeting the 0 level at 382.88, the origin of the entire pullback.

Bearish Scenario

Conversely, a break below the ascending trendline and the 0.618 retracement near 340.66 would expose the 0.786 level near 329.19, with a deeper slide risking a retest of the 314.57 low that anchored this five-month structure.

With price coiled right at the apex of this triangle, sitting exactly on the 200-period EMA, Alphabet’s next move looks set to be decisive. Will the AI spending story finally translate into a genuine breakout, or does the stock settle back into its earlier range?

Buy and sell stocks of the world’s biggest publicly-listed companies with CFDs on FXOpen’s trading platform. Open your FXOpen account now or learn more about trading share CFDs with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Cosmos Labs has disclosed that attackers exploited a critical Cosmos EVM vulnerability across six blockchain networks between Aug. 20 and Aug. 25, converting stolen tokens into about $5.72 million in assets through decentralized and centralized exchanges.

Cosmos Labs said in a technical post-mortem published Friday that the flaw had first been reported through its bug bounty program on April 25, nearly four months before the attacks began. Its testers were unable to reproduce the exploit against configurations used by known production Cosmos EVM networks and concluded at the time that live user funds were not at risk.

Based on that assessment, developers handled the vulnerability through a silent public patch instead of privately distributing a security fix to affected chains. Cosmos Labs merged the fix in May without telling network operators which vulnerability it addressed.

The assessment later proved incorrect after independent researchers established in early August that the bug affected all Cosmos EVM chains. Cosmos Labs then obscured the fix to make reverse engineering more difficult and released patched versions at 7:01 p.m. ET on Aug. 19.

Release notes referred to “important” security fixes without describing the vulnerability. The first known attack began at 3:06 p.m. ET on Aug. 20, about 20 hours after the patched software became available.

Cosmos EVM flaw allowed attackers to drain large accounts

The vulnerability involved an integer underflow in Cosmos EVM, the ecosystem’s Ethereum-compatible framework built from the open-source Evmos codebase.

An attacker could first create an account containing locked tokens and delegate more tokens to a validator than the account was able to spend. Subtracting the delegated amount caused the balance to fall below zero, making the value wrap around to the maximum possible figure of 2^256-1 base units.

The attacker could then use the inflated balance against another account. Sending the amount to a target pushed its recorded balance past the same numerical ceiling, causing an overflow that wrapped the value back down and left the attacker holding the target’s tokens.

No additional tokens were created through the process, according to Cosmos Labs, and total token supply remained effectively unchanged. MANTRA said the exploit changed its supply by only one base unit, the smallest divisible denomination of the token.

Cosmos Labs said attackers targeted accounts holding large balances, including burn addresses and multisignature wallets created when networks launched. Its advisory classified the flaw as critical and identified Cosmos EVM releases before v0.6.2 and v0.7.2 as vulnerable.

The incident followed another security disclosure involving Cosmos software earlier this year. Crypto.news previously reported that a researcher had disclosed a CometBFT flaw in April that could cause nodes to stall during block synchronization. The CVSS 7.1 issue did not allow direct asset theft.

Networks had about 20 hours after the patch

Once independent researchers confirmed the Cosmos EVM flaw could affect production chains, Cosmos Labs prepared the security releases that went live on Aug. 19.

Network operators were not given a vulnerability-specific warning explaining what the upgrade fixed. MANTRA later said 20 hours was not enough to assess, build, test and coordinate a state-breaking upgrade across its 38 independent validators.

“Twenty hours was not a realistic window in which to assess, build, test and coordinate a state-breaking upgrade across 38 independent validators, particularly without a vulnerability-specific advisory,” MANTRA wrote in its post-mortem.

Another disclosure occurred before the first theft. At 3:16 a.m. ET on Aug. 20, a Push Chain developer publicly submitted a code change describing the vulnerability and its exploitation path. The filing credited the finding to an audit by security firm Hacken and listed versions considered vulnerable.

The submission said no released version contained the fix, though its version table omitted v0.6.2 and v0.7.2, which Cosmos Labs had published roughly eight hours earlier.

Cosmos Labs described publication of an exact exploitation path by a downstream developer as “highly unusual” and said such disclosures can raise the risk that a vulnerability will be exploited.

MANTRA placed the public security finding 11 hours and 45 minutes before the attacker’s first probe. However, the attacker’s wallet had been funded almost four hours before the finding was filed.

“We state the timing as fact and draw no conclusion from it,” MANTRA said.

A withdrawal of 472.70 MANTRA from a customer account at a centralized exchange funded the gas fees used throughout the attack, according to the network.

MANTRA lost $3.6 million before halting its chain

MANTRA suffered the largest publicly disclosed loss from the attacks, with 720.9 million MANTRA tokens then valued at about $3.6 million taken from two addresses.

One was the network’s burn address. The second was a dormant multisignature wallet left from an earlier incentive campaign.

No automated warning was generated when tokens first moved from the burn address because MANTRA’s monitoring systems treated the address as immovable and did not watch it for outgoing transactions.

The attack remained undetected for almost four hours, giving the attacker time to drain the dormant multisig wallet.

MANTRA halted the network at 7:13 p.m. ET on Aug. 20. About 38 million stolen MANTRA remained frozen in the attacker’s wallet, but 94.7% of the stolen tokens had already been transferred to one centralized exchange deposit address through 15 transactions.

The chain remained unable to process transactions for roughly 30 hours. Crypto.news reported during the interruption that MANTRA halted transactions while engineering and security teams investigated the incident and exchanges suspended deposits and withdrawals.

Validators later deployed patched software and resumed block production without rolling back the chain or altering user balances. Version 8.4.0 included the Cosmos EVM security fix.

MANTRA had added native EVM support to its mainnet in September 2025 alongside CosmWasm compatibility, allowing Solidity applications and Cosmos-native smart contracts to operate on the network.

No stolen MANTRA tokens had been recovered as of Aug. 28, according to the project.

Its circulating supply increased by about 720.9 million tokens because assets held in accounts previously classified as unspendable, including the burn address, became tradable after being moved by the attacker.

TAC and KiiChain were hit after MANTRA

The same method was used against TAC on Aug. 22, according to Cosmos Labs. Nearly 3 billion TAC were taken from the network’s staking pool.

TAC is designed to bring decentralized finance applications to TON and Telegram users. Around 1.2 billion of the stolen tokens were sold on BNB Chain for roughly $950,000.

KiiChain was attacked that evening, losing approximately 148 million KII. About 64.6 million tokens were sold for roughly $1.6 million.

Cosmos Labs estimated that around 54% of the stolen KII remains recoverable onchain if the network is restored.

In its Aug. 23 technical post-mortem, KiiChain criticized how the vulnerability had been communicated to downstream networks. The project said Cosmos Labs did not provide advance notice, identify the release as security critical or initially tell affected chains to halt.

“A patch takes days to review, build, test and roll out across a validator set. A halt takes minutes,” KiiChain wrote. “The only measure that would have contained the risk immediately was a clear instruction to stop producing blocks, and that instruction came after the damage was done.”

Cosmos Labs recommended that vulnerable networks halt on Aug. 22, after MANTRA, TAC and KiiChain had already been hit.

KiiChain disputed part of the technical assessment as well, saying three upstream defects were needed to carry out the exploit and that only the underflow had been publicly patched.

MANTRA reached a different conclusion after testing the fix against a working reproduction of the exploit. Its post-mortem described the underflow repair as “the control that closes this attack path.”

Cosmos Labs described two chained vulnerabilities but did not address KiiChain’s claim that another upstream defect remains unresolved.

Three other Cosmos EVM networks were attacked

Three further chains were exploited with the same method, though Cosmos Labs did not identify them in its report.

Nesa may have been one of the affected networks. Bitvavo suspended NES deposits and withdrawals on Aug. 24, citing a critical consensus vulnerability that had been exploited to make vulnerable nodes accept invalid blocks.

Blockchain analytics firm Bubblemaps identified Nesa as one of the affected chains in an Aug. 26 analysis. The firm said an attacker bought about $250,000 worth of NES, bridged it to Nesa, used the flaw to increase the balance about 200-fold and transferred roughly $50 million in NES back to Ethereum.

Most attempted swaps suffered extreme slippage as liquidity was removed from trading pools, leaving the attacker with about $60,000 in profit, according to Bubblemaps.

The wallet had originally been funded through Monero. Bubblemaps said differences in the funding method and the attacker’s behavior meant a separate party may have been responsible for the Nesa exploit.

The remaining two affected chains have not been publicly identified.

Cosmos Labs said it coordinated with 40 networks during its response and worked with 13 others to patch the vulnerability or halt before they were attacked.

The firm said it does not maintain a complete registry of the more than 115 public blockchains operating across the Cosmos ecosystem. Its response uncovered 11 Cosmos EVM deployments that had not previously been registered with the team.

MANTRA, meanwhile, is being acquired by existing backer Inveniam Capital Partners, which had made a $20 million strategic investment in the project in August 2025. The transaction is expected to close in the third quarter of 2026, with MANTRA Chain, its token and related infrastructure set to continue operating under Inveniam’s ownership.