July 2026 saw $247.4 million in cryptocurrency stolen across multiple incidents, the second-worst month of the year after April's $644 million, according to DefiLlama.
The Coldcard exploit accounted for at least $100 million in Bitcoin losses across 7,300 wallets hit in three confirmed attack waves, Galaxy Digital reported. Galaxy identified a suspected fourth wave that could push total Coldcard losses to roughly $130 million, though DefiLlama's hack tracker estimates $115 million.
The month's theft total tripled June's $75 million and May's $60 million.
Beyond Coldcard, other July incidents included a $9 million exploit on DeFi protocol Bonzo Lend, a $2.6 million theft from SecondFi (a Cardano-based wallet), a $24 million hack on Arbitrum-based perpetual exchange AFX, and $7.5 million drained through an attack on the Verus Ethereum Bridge.
CryptoRank noted in a Thursday X post that the Coldcard incident demonstrated that cold storage does not eliminate technological risks, particularly when vulnerabilities can expose thousands of wallets simultaneously.
