Coldcard exploit pushes July losses to $247M as second-worst month of 2026
Summary
July became 2026’s second-worst month for crypto thefts, with hackers stealing $247.4 million, far above June’s $75 million and May’s $60 million, but below April’s $644 million. The main driver was a Coldcard exploit that drained at least $100 million in Bitcoin from 7,300 wallets across three confirmed attack waves, with a possible fourth wave pushing losses near $130 million. DefiLlama tracks the Coldcard-related losses at about $115 million. The breach highlighted that cold storage still carries technical risks and can expose many wallets at once. Other July attacks included hacks against Bonzo Lend, SecondFi, AFX, and the Verus Ethereum Bridge.
