Cryptocurrency hacking attacks surged to $247 million in July, with Coldcard vulnerabilities becomin

July 2026: Cryptocurrency theft losses reached US$247.4 million, with Coldcard vulnerability becoming the biggest threat

In July 2026, the amount of cryptocurrency theft losses hit the second highest in the year. Hackers stole approximately $247.4 million in assets by attacking multiple targets, including hardware wallets, bridge protocols, lending protocols and trading platforms. This series of attacks highlights the diversity and persistence of vulnerabilities in this field.

Coldcard vulnerabilities account for the bulk of monthly losses

The most serious blow this month came from Coldcard's hardware wallet vulnerability. Galaxy Research found three confirmed waves of attacks that affected approximately 7300 Bitcoin wallets and resulted in the theft of more than $100 million in Bitcoin. A fourth wave of potential attacks could raise the amount of damage to approximately US$130 million, while DefiLlama currently estimates losses at approximately US$115 million. This incident alone accounted for nearly 46% of the total losses in July.

Coldcard wallets were supposed to provide protection by storing private keys offline, but the vulnerability in its wallet recovery information caused attackers to break through the line of defense and attracted criticism. This incident shows that while cold storage reduces the risk of online attacks, it cannot fully protect against vulnerabilities originating from wallet hardware or firmware flaws.

The Coldcards family alone was responsible for the theft of nearly half of digital assets in July, highlighting the increasingly sophisticated attacks on hardware storage solutions.

Major breaches of major protocols and platforms

Arbitrum suffered two major intrusions in July. On July 22, an AFX-related bridging agreement was leaked, resulting in the theft of approximately $24.15 million in assets. The attacker exchanged most of the stolen USDC for Ethereum. Offchain Labs confirmed that Arbitrum's main bridge infrastructure has not been affected.

Just a week ago, the decentralized trading project Ostium was hacked into its off-chain pricing system, resulting in the withdrawal of $23.75 million in funds. The attacker forged price data to execute fraudulent transactions against Ostium's liquidity provider vault. The platform insists traders 'mortgage reserves are safe and separated from affected coffers.

Bonzo Lend on the Hedera network reported that due to a vulnerability in a third-party oracle verification system, attackers were able to manipulate the price of SAUCE tokens, resulting in a loss of $9 million. Analogously high prices allow attackers to borrow assets well above the value of legal collateral. Bonzo later said the recovery facility supported by the Hedera Foundation would compensate affected users.

Widespread impact on cryptocurrency security

Other noteworthy incidents include cryptocurrency payment provider Triple-A suffered a hot wallet intrusion that lost US$9.7 million and affected the infrastructure of multiple blockchains. DefiLlama classified it as a hot wallet vulnerability, but Triple-A guarantees that customer funds are quarantined and unaffected.

Bridging vulnerabilities remain the hardest hit area. The Verus-Ethereum Bridge lost $7.53 million due to a bridge verification bypass vulnerability, and Wanchain lost $6.5 million due to a signature attack.

In addition, the Crypto DAO vulnerability lost $8.2 million and the Allbridge Core attack lost $1.65 million, events that further exacerbated losses this month. Many of these intrusions involve loopholes in oracle data manipulation or exploiting mobile infrastructure.

Industry Developments and New Solutions

The current threat landscape shows that attackers are no longer limited to traditional smart contract vulnerabilities. Platform security must now consider the risks associated with private keys, hardware wallets, bridge protocols, oracles, and large operating systems. While complex attacks are emerging, some platforms, such as 1stepSwap, have begun to bridge traditional finance and cryptocurrencies by introducing real-world assets such as U.S. stocks, gold and silver into blockchain networks. Users can now access these assets directly from their wallets and enjoy automatic price optimization without relying on multiple intermediaries. This integrated approach may encourage further diversification and speed up response to major market events.

The wave of hacking attacks in July showed that the attack surface of cryptocurrencies now covers hardware vulnerabilities, bridging vulnerabilities, oracle damage and weaknesses in operational infrastructure, resulting in tens of millions of dollars in losses.

The July incidents also highlighted multiple ongoing recovery and shutdown efforts, such as the attack on Cardano wallet SecondFi, which resulted in losses ranging from $2.4 million to $2.6 million. Although most of the attack occurred in June, the subsequent impact and resolution process continued into July, eventually prompting the team to cease service.