July 2026 recorded $247.4 million in cryptocurrency thefts, making it the second-worst month of the year for stolen digital assets—behind the $644 million lost in April, according to DefiLlama data.
The July total is more than three times the $75 million stolen in June and the $60 million in May.
Galaxy Digital confirmed the Coldcard hardware wallet exploit resulted in at least $100 million in Bitcoin stolen from 7,300 wallets across three attack waves. DefiLlama's hack tracker placed losses tied to the Coldcard incident at $115 million.
Galaxy Digital identified a suspected fourth wave of the exploit that could push total losses from the incident to approximately $130 million, primarily affecting Bitcoin holdings.
"July showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously," CryptoRank said in a Thursday post.
Beyond Coldcard, the Arbitrum-based perpetual exchange AFX lost $24 million to an exploit. Bonzo Lend lost $9 million from its liquidity pools. The Verus Ethereum Bridge recorded a $7.5 million theft, and Cardano-based wallet SecondFi was exploited for $2.6 million.
AFX's exploit triggered immediate capital flight and a drop in TVL on Arbitrum, compressing trading volumes on the platform. The $9 million loss at Bonzo Lend directly hit its lending pools, raising the risk of bad debt and reduced yields for lenders—outcomes that typically trigger emergency governance proposals for recovery or compensation.
The Coldcard incident also prompts a re-evaluation of supply chain integrity and security audits for hardware wallet manufacturers, given that the attack targeted a segment of users widely regarded as among the most security-conscious in the market.
