Crypto Law Brief: Strategy's $370 Million Return, a One-Satoshi Balancer Exploit, and $215 Million Lost in August

The first two days of September delivered a corporate treasury reversal, a rounding bug that turned one satoshi into thousands of pool tokens, and a monthly loss tally that looks better on paper than it does in practice. Below is what Strategy's latest 8-K actually discloses, why a dissolved company leaves burned liquidity providers with nobody solvent to sue, and how a Fed rate-hike bet is colliding with roughly $1.5 billion in September token unlocks.

Strategy Returns to the Bitcoin Market With a $370 Million Buy

On August 31, Strategy Inc. disclosed in a Form 8-K that it had purchased 4,603 bitcoin for approximately $369.7 million, at an average price of $80,318 per coin. The purchase brings the company's total holdings to 845,050 BTC and marks its first acquisition in more than two months, following four consecutive periods of selling. The company funded the buy with net proceeds from sales of newly issued MSTR shares, using the remainder for dividends, STRC repurchases, and roughly $30 million added to its cash balance.

The sequence is the part worth reading closely. A company that sells bitcoin and then repurchases at a higher average price is inviting scrutiny of what it said, and did not say, at the time of the sales. Corporate treasury disclosure around digital assets is not standardized the way quarterly financials are, and much of what investors rely on arrives through voluntary 8-K filings rather than mandated line items. For shareholders, the practical question is whether the at-the-market equity program funding these purchases is described with enough specificity that a reasonable investor understands the dilution being traded for exposure.

A One-Satoshi Rounding Bug Drains a Balancer V1 Pool

Security firm SlowMist reported on August 31 that a legacy Balancer V1-style liquidity pool lost roughly $234,000 to a rounding-error exploit. Using flash loans, the attacker drove the pool's wrapped bitcoin reserves down to dust, then exploited fixed-point math in the joinswapPoolAmountOut and calcSingleInGivenPoolOut functions to mint 4,408.8 pool tokens for an input of a single satoshi. The pool lacked a minimum effective input, a minimum balance floor, and relative-error validation. It belongs to the same bug family that drained $116 million from Balancer V2 pools last November.

Here is the legal wrinkle. Balancer Labs wound down as a company in March 2026 after that earlier incident, which means liquidity providers hit by this exploit have no solvent developer entity to pursue. The exposure now sits with forked protocols that copied the pool logic and are still collecting fees on it. Once a public warning about a known vulnerability circulates, a fork operator who continues soliciting deposits without patching or disclosing is in a materially different position than one who was simply unlucky. Notice changes the analysis.

CertiK Puts August Losses at $215 Million

Also on August 31, CertiK reported that confirmed incidents during August 2026 produced approximately $215 million in losses. DeFi accounted for $144.6 million. By vector, price manipulation led at $131.6 million, followed by phishing at $41.5 million, code vulnerabilities at $20.6 million, wallet compromise at $11.8 million, and governance attacks at $8.5 million. The single largest incident was Tectonic, the lending protocol on the Crypto.com-linked Cronos chain, listed at $120.4 million. CertiK classified about $110.7 million as returned or frozen.

That last figure deserves a caveat. Frozen is not returned, and neither is the same as recovered by the person who lost the money. Frozen assets typically sit with an exchange, a custodian, or a validator set pending some release mechanism, which may be a court order, a protocol vote, or a negotiated settlement. Victims who have not documented their loss and asserted a claim before that mechanism runs its course often find that the funds move without them.

A Rate-Hike Bet Meets $1.5 Billion in Token Unlocks

Bitcoin opened Tuesday, September 1, at $78,559.11, up 1.1% from Monday, then slipped to $77,945.97 by 8:19 a.m. Eastern. Ethereum followed a similar path, opening at $2,467.13 and easing to $2,454.23. The pullback tracks rising expectations of Fed tightening, with CME FedWatch pricing a 66.4% probability of a 25-basis-point hike later in September. August was strong by contrast, with bitcoin up nearly 25% on roughly $3.5 billion in U.S. spot ETF inflows. Meanwhile, about $1.5 billion in token unlocks arrives in early September, including 13.53 million SUI worth roughly $9.73 million released on September 1.

Unlock schedules are disclosure documents, not just calendar entries. A project whose published vesting terms are vague, or whose actual releases diverge from what investors were told, hands plaintiffs a straightforward factual claim that does not depend on resolving whether the token is a security.

What This Means for You

If you provide liquidity to any DeFi protocol, find out whether its code is forked from an abandoned codebase and whether anyone is still maintaining it. A protocol with no active security team and no solvent entity behind it is not merely a technical risk, it is a recovery problem. If you hold shares in a public company with a large bitcoin treasury, read the 8-Ks rather than the headlines, and pay attention to how purchases are funded. If you were affected by an August incident, do not assume that funds reported as frozen will find their way back to you automatically.

On the legal side, documentation is what separates a claim from a complaint. Preserve transaction hashes, wallet addresses, timestamps, screenshots of protocol terms as they appeared when you deposited, and any communications from the project. Statutes of limitations for fraud, breach of contract, and unjust enrichment vary by state and by theory, and some of them start running from the date of loss rather than the date you discovered it. If a receiver, a bankruptcy estate, or a government forfeiture proceeding is involved, claim deadlines can be much shorter than the underlying limitations period.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.