Hackers stole $247.4 million in cryptocurrency during July, the second-worst month of 2026 for digital asset thefts, largely driven by a Coldcard exploit that affected 7,300 wallets across three confirmed attack waves.
The Coldcard breach accounted for at least $100 million in stolen Bitcoin. Galaxy Digital identified a suspected fourth attack wave that could push total Coldcard losses to approximately $130 million, while DefiLlama's hack tracker estimates $115 million specifically tied to the exploit.
July's total theft volume follows April 2026, which saw $644 million stolen. July thefts were more than triple the $75 million stolen in June and exceeded the $60 million recorded in May.
CryptoRank noted on X that "July showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously."
Beyond Coldcard, several other exploits contributed to July's total. Perpetual exchange AFX lost $24 million through an exploit. The Verus Ethereum Bridge was targeted for $7.5 million, while DeFi protocol Bonzo Lend suffered a $9 million hack. The Cardano-based wallet SecondFi lost $2.6 million.
