The crypto risk picture heading into the final weekend of August is being shaped less by broad market volatility than by infrastructure security, exchange exit deadlines and the consequences of weak custody or collateral controls.
The largest newly tracked loss is the Moonwell exploit on Base, where security researchers estimate that an attacker extracted roughly $8.7 million after manipulating the price of the relatively illiquid MAMO collateral asset. Core Lightning, meanwhile, has moved from vulnerability warning to active remediation: version 26.06.7 is now available and node operators have been urged to upgrade before technical details are publicly disclosed.
Centralized-exchange users also face several hard deadlines. Luno customers in regions the exchange is exiting have until August 31 to sell crypto and withdraw fiat to their bank accounts. Kraken has already closed withdrawals for 21 delisted assets and will liquidate remaining balances between September 1 and September 5, including assets with thin or inactive markets. Coinbase has separately announced that BADGER and STORJ trading will be suspended on September 28.
A separate custody incident at Realio Network's realio.fund platform illustrates a different type of risk. The available evidence indicates that the attacker compromised signing infrastructure rather than exploiting a token smart contract, allowing treasury and custodial assets to be moved across multiple chains.
Today's key risk developments
| Risk | Event | Latest development |
|---|---|---|
| Critical | Moonwell MAMO exploit | Security firms estimate roughly $8.7M was extracted after MAMO price manipulation on Base. Borrowing in affected Core Markets was heavily restricted. |
| High | Core Lightning security update | Version 26.06.7 was released on August 28 to patch multiple security issues. Technical details remain under a temporary disclosure embargo. |
| High | Luno regional exit | August 31 is the final normal bank-withdrawal deadline for customers in affected regions; accounts close September 1. |
| High | Realio signing-infrastructure breach | Roughly 128M–129.5M RIO was moved across five chains after realio.fund's signing infrastructure was compromised. Nominal token value materially exceeds realized liquid proceeds. |
| Medium | Kraken forced liquidation | Withdrawals for 21 delisted assets closed August 27. Remaining balances will be liquidated September 1–5, potentially into very thin markets. |
| Medium | Coinbase BADGER/STORJ suspension | Trading is scheduled to stop September 28. Order books are already limit-only, while withdrawals remain available. |
| Medium | BIS stablecoin warning | BIS General Manager Pablo Hernández de Cos argued that stablecoins in their current form are not ready to function as money at scale and highlighted redemption, interoperability and integrity risks. |
1. Moonwell: an illiquid collateral market became an $8.7M attack surface
Moonwell is investigating an exploit affecting its MAMO Core Market on Base.
The attack is significant because the available evidence points to a collateral-pricing failure rather than a conventional private-key theft. The attacker appears to have driven up the price of MAMO, a comparatively illiquid token that could be used as collateral, and then borrowed more liquid assets against the inflated valuation.
Security firms including CertiK and PeckShield put the loss at roughly $8.7 million. Moonwell responded by setting borrow caps across Base Core Markets to 1 wei and sharply restricting the MAMO and WELL supply caps, preventing new borrowing while the incident is investigated.
Read the full analysis: Moonwell Exploit 2026: How MAMO Price Manipulation Drained About $8.7M
2. Core Lightning: the security patch is now available
Core Lightning's risk status changed materially on August 28.
The project released version 26.06.7 after multiple security issues were responsibly reported and validated. Node operators have been urged to upgrade promptly. The exact vulnerabilities remain under a temporary disclosure embargo intended to give operators time to patch before exploitation details become widely available.
There is no public evidence at this stage that the newly patched issues have been exploited at scale.
Read the full analysis: Core Lightning Security Update 2026: Why Node Operators Should Upgrade to 26.06.7
3. Luno: the normal exit window is about to close
Customers in regions Luno is leaving face a hard operational deadline.
Luno's official guidance says August 31 is the last day affected users can sell crypto and withdraw funds to a linked bank account. Accounts are scheduled for permanent closure on September 1.
The more restrictive crypto-transfer deadline has already passed. Since June 29, affected users have not been able to send crypto to an external wallet or another exchange through the normal process.
Read the full analysis: Luno Exit 2026: August 31 Withdrawal Deadline and Account Closures
4. Realio: a signing compromise crossed five chains
Available security reporting and on-chain analysis indicate that attackers compromised the signing infrastructure behind realio.fund, allowing assets to be transferred from treasury and custodial wallets across Ethereum, BNB Chain, Algorand, Stellar and the Realio native network.
Roughly 128–129.5 million RIO has been attributed to the incident. At quoted market prices, that produced a nominal figure near $6 million. But the attacker could not realize anything close to that amount because RIO liquidity is shallow.
Read the full analysis: Realio Network Breach 2026: What the Multi-Chain Signing-Key Compromise Means
5. Kraken: withdrawal access is over for 21 delisted assets
Withdrawals for 21 affected assets ended on August 27 at 14:00 UTC. Kraken says remaining customer balances will be automatically liquidated between September 1 and September 5.
Kraken explicitly warns that certain markets are limited or inactive, so liquidation prices may be substantially below recent reference prices and may produce minimal or no proceeds in extreme cases.
Read the full analysis: Kraken Delisting 2026: 21 Assets Enter Forced Liquidation After Withdrawal Deadline
6. Coinbase: BADGER and STORJ enter a one-month exit period
Coinbase announced on August 28 that it will suspend trading for Badger DAO (BADGER) and Storj (STORJ) on September 28 at approximately 2:00 p.m. ET.
The assets have already moved into limit-only mode. Coinbase says users retain access to their balances and can continue to withdraw their tokens.
Read the full analysis: Coinbase BADGER and STORJ Delisting 2026: What Holders Need to Know
7. BIS: the stablecoin debate is shifting from growth to monetary design
BIS General Manager Pablo Hernández de Cos argued on August 28 that current stablecoin structures still fall short of several properties expected of money at scale, including par convertibility, interoperability, settlement integrity and liquidity under stress.
The speech is not an enforcement action. It is important because it signals how central-bank policy thinking may shape future stablecoin rules.
Read the full analysis: BIS Stablecoin Warning 2026: Why Stablecoins Still Face Payment-System Risks
Ongoing high-risk events from the August 27 brief
Several previously published CEXVia reports remain active but do not have enough new verified information to justify a new URL today.
BitMart — Critical
Trading has stopped and the exchange remains in a restructuring process. The next major milestone is the roadmap BitMart said it aims to provide by September 9.
Read the BitMart restructuring report →
AscendEX — Critical
Customer withdrawals remain the central issue. The initial Claims Portal is targeted for September 5.
Read the AscendEX claims and insolvency report →
BitMEX — High
BitMEX remains in its reduce-only wind-down phase ahead of the September 23 exchange closure.
Read the BitMEX shutdown report →
WOO X — High
The Seychelles FSA warning remains unresolved. CEXVia has not identified a public WOO X response that materially changes the regulator's position.
Read the WOO X Seychelles warning →
aelf — High
The latest official incident update located by CEXVia still describes the network as being in controlled recovery.
Read the aelf security incident report →
Coldcard — Critical
The hardware-wallet seed-generation incident remains a live on-chain watch.
Read the Coldcard exploit report →
WebSea — High
WebSea says automatic withdrawals have resumed, but independent evidence of full and durable normalization remains limited.
Read the WebSea withdrawal report →
SEC crypto custody rule — Medium
The SEC's new custody rulemaking remains under OIRA review.
Read the SEC custody rule report →
What CEXVia is watching next
- August 31: Luno's normal bank-withdrawal deadline for affected regions.
- September 1: affected Luno accounts close.
- September 1–5: Kraken liquidates remaining balances in the 21 delisted assets.
- September 5: AscendEX's targeted Claims Portal launch.
- September 9: BitMart's targeted restructuring-roadmap update.
- Mid-September: Core Lightning vulnerability details may become public after the disclosure embargo.
- September 23: BitMEX exchange trading ends.
- September 28: Coinbase suspends BADGER and STORJ trading.
CEXVia is also monitoring Moonwell's final bad-debt and remediation figures, Realio's recovery plan, WOO X's response to the Seychelles FSA, aelf's formal reopening notice, Coldcard attacker-wallet movements and the SEC custody proposal.
CEXVia daily risk view
The common thread across today's highest-value risk events is control failure at system boundaries.
Moonwell's risk surfaced where a thin collateral market met lending limits and price discovery. Realio's risk surfaced where a centralized signing layer controlled assets across multiple chains. Core Lightning's risk now depends on how quickly infrastructure operators patch before technical details are disclosed. Luno and Kraken, meanwhile, show why exit deadlines can themselves become user-protection events even when the underlying exchange is not insolvent.
For users, "funds are still accessible" is not a complete risk assessment. The relevant questions are how they are accessible, for how long, through which legal or technical path, and under what liquidity conditions.
*This brief is for informational purposes only and does not constitute financial, legal or investment advice.*