Monthly Crypto Hack Report: $247 Million Stolen in July

July became the second-worst month of 2026 for cryptocurrency theft after hackers stole an estimated $247.4 million. The attacks spanned everything from hardware wallets and bridges to lending protocols and trading platforms. The total was more than triple the roughly $75 million that was stolen in June and four times May’s $60 million, according to DefiLlama data. Only April, when losses reached approximately $644 million, has recorded more stolen crypto this year. Monthly sum stolen through crypto hacks (Source: DeFiLlama) The defining incident was the Coldcard hardware wallet exploit, but July also showed just how attackers continue to target oracle systems, private keys, bridges and operational infrastructure. Coldcard exploit dominates July lossesColdcard was responsible for by far the largest theft of the month. Galaxy Research identified at least three confirmed attack waves affecting roughly 7,300 Bitcoin wallets and resulting in more than $100 million in stolen BTC. A suspected fourth wave could raise losses to approximately $130 million. DefiLlama currently estimates the incident at around $115 million. Using DefiLlama's estimate, Coldcard alone accounted for roughly 46% of all crypto stolen during July. The incident was particularly painful because Coldcard is a hardware wallet that is designed to keep private keys offline. The vulnerability was linked to how affected versions generated wallet recovery information. This is proof that cold storage can reduce exposure to online attacks, but it does not eliminate risks originating inside wallet hardware or firmware. AFX and Ostium lose nearly $48 million combinedArbitrum also experienced two of July's largest security incidents. An AFX-related bridge suffered a private-key compromise on July 22 that resulted in approximately $24.15 million being stolen. The attacker converted a lot of the stolen USDC into Ethereum. Offchain Labs said Arbitrum's native bridge itself was not compromised. A week earlier, decentralized trading platform Ostium lost another $23.75 million after its off-chain price infrastructure was compromised. The attacker submitted fabricated price reports and used them to generate artificially profitable trades against Ostium's liquidity provider vault. Ostium said trader collateral was stored separately and was not affected. Bonzo Lend hit through third-party oracleHedera-based lending protocol Bonzo Lend lost about $9 million on July 11 after an attacker manipulated the price of SAUCE through a vulnerability in a third-party oracle's verification system. The manipulated price dramatically inflated the value of the attacker's collateral, which allowed assets to be borrowed far beyond the collateral's true value. Bonzo later announced that affected user positions would be covered through a recovery facility backed by the Hedera Foundation. Triple-A hot wallets drainedCrypto payments company Triple-A was another major infrastructure target. Attackers gained unauthorized access to company hot wallets across multiple blockchains in late July, with initial estimates placing losses around $9.7 million. DefiLlama classifies the incident as a hot-wallet compromise.