Crypto thefts reached $247.4 million in July 2026, the second-worst month for stolen digital assets this year, with the Coldcard hardware wallet exploit as the primary driver.
The Coldcard incident alone accounted for $115 million in Bitcoin stolen across at least three confirmed attack waves affecting 7,300 wallets, according to DefiLlama's hack tracker and Galaxy Digital research. Galaxy Digital also identified a suspected fourth wave that could push total losses from the exploit to approximately $130 million.
July's aggregate theft figure triples June's $75 million and May's $60 million, surpassed only by April's $644 million.
Beyond Coldcard, multiple DeFi protocols and bridges sustained significant losses: Bonzo Lend lost $9 million, SecondFi (operating on Cardano) lost $2.6 million, the Arbitrum-based perpetual exchange AFX lost $24 million, and the Verus Ethereum Bridge lost $7.5 million. The incidents underscore persistent attack vectors across cold storage solutions and bridge infrastructure.
