July 2026 recorded $247.4 million in cryptocurrency thefts, the second-worst month of the year. The total triples June's $75 million and May's $60 million, trailing only April's $644 million in losses.
The Coldcard hardware wallet exploit emerged as the largest single incident. Galaxy Digital confirmed at least $100 million in Bitcoin was stolen from 7,300 wallets across three attack waves, with DefiLlama's hack tracker estimating losses tied to the exploit at $115 million. Galaxy Digital identified a suspected fourth wave that could push total Coldcard losses to approximately $130 million.
Beyond Coldcard, several other protocols and bridges suffered substantial breaches. The Arbitrum-based perpetual exchange AFX lost $24 million. DeFi lending protocol Bonzo Lend suffered a $9 million hack. SecondFi, operating on Cardano, saw $2.6 million stolen. The Verus Ethereum Bridge was targeted for $7.5 million, highlighting ongoing security gaps in cross-chain infrastructure.
The incidents underscore persistent vulnerabilities in custody and bridge infrastructure. Even hardware-level security and established platforms remain targets for sophisticated attackers.
