Crypto projects, wallets and infrastructure providers lost an estimated $210.3 million across 30 major hacks in July, marking a 177.2% increase from the $75.87 million recorded in June.
PeckShield’s July security tally placed the Coldcard-linked wallet drains at approximately $70 million, followed by AFX Trade and Ostium at roughly $24 million each. The month also produced losses across governance systems, bridges, oracle infrastructure, project-controlled wallets and privileged smart contracts.
Coldcard Drain Becomes Third-Largest Theft Of 2026
The Coldcard case became July’s largest security loss after Block researchers traced as much as 1,082.59 BTC across two groups of transactions sharing the same wallet fingerprint.
Coinkite has warned users who generated seeds on Coldcard Mk3 firmware versions 4.0.1 through 5.0.3 to treat those wallets as potentially exposed. The vulnerability produced seeds with substantially less randomness than intended, allowing an attacker with enough information about the setup process to narrow the possible recovery phrases.
The approximately $70 million loss ranks behind the $292 million KelpDAO and LayerZero bridge exploit and the $285 million Drift Protocol breach among reported crypto thefts in 2026. Coinkite has not established that every transaction identified by Block resulted from the Mk3 weakness.
Bridges, Oracles And Governance Failures Drive Losses
AFX Trade’s Arbitrum bridge lost 24.15 million USDC after signatures associated with five hot validators cleared the required approval threshold. The attacker moved the stablecoins to Ethereum and exchanged them for approximately 12,467 ETH.
PeckShield raised the estimated loss from the Ostium oracle exploit to roughly $24 million, above the initial estimate of as much as $18 million. The attacker used authorized, future-dated price reports to generate artificial trading profits against the protocol’s USDC liquidity vault.
A malicious proposal then removed about $21.2 million from the BonkDAO treasury, while Wanchain’s Cardano-BNB Chain bridge lost approximately $13 million after 515 million NIGHT left its treasury through transactions tied to a suspected signature-reuse weakness.
Five More Incidents Add Nearly $39 Million
Wallets linked to payments provider Triple-A lost more than $9.7 million across four networks before the assets were consolidated on Ethereum.
Bonzo Lend suffered a $9.05 million oracle exploit, while the Verus Ethereum Bridge lost $7.54 million through an import-validation failure that released assets without matching deposits.
WEMIX placed damage from its contract ownership compromise near $6.25 million, and a vault-accounting exploit removed approximately $6.04 million from Summer.fi.
The 10 largest incidents accounted for approximately $191 million, leaving about $19.3 million across July’s remaining 20 hacks.
