Monthly Crypto Hack Report: $247 Million Stolen in July

July became the second-worst month of 2026 for cryptocurrency theft after hackers stole an estimated $247.4 million. The attacks spanned everything from hardware wallets and bridges to lending protocols and trading platforms.

The total was more than triple the roughly $75 million that was stolen in June and four times May’s $60 million, according to DefiLlama data. Only April, when losses reached approximately $644 million, has recorded more stolen crypto this year.

Monthly sum stolen through crypto hacks (Source: DeFiLlama)

The defining incident was the Coldcard hardware wallet exploit, but July also showed just how attackers continue to target oracle systems, private keys, bridges and operational infrastructure.

Coldcard was responsible for by far the largest theft of the month. Galaxy Research identified at least three confirmed attack waves affecting roughly 7,300 Bitcoin wallets and resulting in more than $100 million in stolen BTC. A suspected fourth wave could raise losses to approximately $130 million. DefiLlama currently estimates the incident at around $115 million.

Using DefiLlama's estimate, Coldcard alone accounted for roughly 46% of all crypto stolen during July.

The incident was particularly painful because Coldcard is a hardware wallet that is designed to keep private keys offline. The vulnerability was linked to how affected versions generated wallet recovery information. This is proof that cold storage can reduce exposure to online attacks, but it does not eliminate risks originating inside wallet hardware or firmware.

Arbitrum also experienced two of July's largest security incidents. An AFX-related bridge suffered a private-key compromise on July 22 that resulted in approximately $24.15 million being stolen. The attacker converted a lot  of the stolen USDC into Ethereum. Offchain Labs said Arbitrum's native bridge itself was not compromised.

A week earlier, decentralized trading platform Ostium lost another $23.75 million after its off-chain price infrastructure was compromised.

The attacker submitted fabricated price reports and used them to generate artificially profitable trades against Ostium's liquidity provider vault. Ostium said trader collateral was stored separately and was not affected.

Hedera-based lending protocol Bonzo Lend lost about $9 million on July 11 after an attacker manipulated the price of SAUCE through a vulnerability in a third-party oracle's verification system.

The manipulated price dramatically inflated the value of the attacker's collateral, which allowed assets to be borrowed far beyond the collateral's true value. Bonzo later announced that affected user positions would be covered through a recovery facility backed by the Hedera Foundation.

Crypto payments company Triple-A was another major infrastructure target.

Attackers gained unauthorized access to company hot wallets across multiple blockchains in late July, with initial estimates placing losses around $9.7 million. DefiLlama classifies the incident as a hot-wallet compromise. Triple-A said customer funds were held separately and were unaffected.

The Verus-Ethereum Bridge lost approximately $7.53 million on July 22 through what DefiLlama classified as a bridge verification bypass. Wanchain suffered another $6.5 million loss a day earlier in a signature-related exploit.

Several smaller incidents added to the month's tally, including an $8.2 million Crypto DAO exploit, a $1.65 million Allbridge Core attack and multiple oracle and liquidity-manipulation incidents.

One major distinction concerns SecondFi. The Cardano wallet lost roughly $2.4 million to $2.6 million and featured in several July hack roundups, but SecondFi's own timeline says the principal attack waves occurred between June 21 and June 23. The fallout, recovery effort and eventual decision to shut down continued throughout July.

July's incidents ultimately show that crypto's attack surface now extends well beyond vulnerable smart contracts. Private keys, hardware wallets, oracle infrastructure, bridges and operational systems all provided attackers with paths to multimillion-dollar losses.