Hackers stole $247.4 million in cryptocurrency during July, making it the second-worst month for crypto thefts in 2026, according to DefiLlama data. The losses were largely driven by a major exploit affecting Coldcard hardware wallets.
July's total represented a sharp increase from prior months. The $247.4 million stolen was more than triple the $75 million in June and the $60 million in May. Only April exceeded July's losses, with $644 million in thefts.
At least $100 million in Bitcoin was stolen from 7,300 Coldcard wallets, according to Galaxy Digital. The firm confirmed three initial attack waves and identified a suspected fourth wave that could push total losses to approximately $130 million. DefiLlama's hack tracker estimates losses directly tied to Coldcard at $115 million.
The Coldcard exploit demonstrated that cold storage solutions carry technological risks despite their security-focused design. Research platform CryptoRank stated the incident "showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously."
Beyond the hardware wallet breach, multiple DeFi and infrastructure components experienced significant exploits in July. Bonzo Lend lost $9 million, while AFX, a perpetual exchange on Arbitrum, had $24 million stolen, impacting on-chain derivatives activity. The Cardano-based wallet SecondFi lost $2.6 million, and the Verus Ethereum Bridge suffered $7.5 million in losses, affecting cross-chain liquidity flows.
The exploits span custody, DeFi lending, perpetual exchanges, and cross-chain bridges. The Coldcard breach in particular exposed how security-focused hardware can become a systemic failure point, challenging assumptions about absolute safety in self-custody. The breadth of attacks across multiple layers indicates vulnerabilities are not isolated to a single vector but distributed across fundamental DeFi infrastructure.
