Introduction
July 2026 was one of the most damaging months of the year for the cryptocurrency ecosystem. Across the 28 major incidents analysed in this report, attackers stole approximately $242 million, spanning DeFi lending and derivatives protocols, cross-chain bridges, a regulated crypto payment institution, and, most significantly, a landmark hardware-wallet firmware exploit that struck at the foundations of Bitcoin self-custody.
The month's loss profile was heavily shaped by a single event. The exploitation of a five-year-old firmware flaw in Coinkite's Coldcard hardware wallet accounted for roughly $116 million on its own, drained across four waves from 30 July into early August. Even setting the Coldcard incident aside, the remaining 27 incidents still produced approximately $126 million in losses, a marked increase on the roughly $62 million recorded across the major incidents of June.
More important than the headline number is where the losses came from. Consistent with the trend that has defined 2026, attackers were far less reliant on novel smart contract logic bugs than on compromised keys, seeds, credentials and privileged access. Private key leakage, hot wallet compromise, access-control failure, account takeover and the Coldcard seed-generation flaw together accounted for the clear majority of all funds stolen during the month. In other words, the most expensive failures were operational and off-chain rather than errors in on-chain code.
A second, persistent theme was oracle and price manipulation. A cluster of incidents, including the $24 million Ostium exploit, abused price-feed infrastructure, compromised oracle-signer credentials or manipulated on-chain prices to drain liquidity from lending and derivatives platforms. Cross-chain bridges once again featured prominently as a target category, and Tornado Cash reappeared as the laundering venue of choice across multiple incidents.
Taken together, July 2026 reinforces a message that has grown steadily louder throughout the year: as smart contract auditing matures, attackers are moving upstream to the keys, credentials, oracles and trust relationships that sit around the code, and the consequences of a single compromised key or a single weak seed can now run into nine figures.
Major crypto attacks in July 2026
Edel Finance - 01/07/2026
Type: Smart Contract Exploit
The month opened with an exploit of Edel Finance, a DeFi lending protocol. An attacker abused a flaw in the protocol's smart contract logic to extract assets, including the wGOOGLx token, beyond what the protocol's rules should have permitted. As with most smart contract exploits of this kind, the attacker did not require access to any user's wallet; the vulnerability lay in the contract's own handling of balances and permissions.
Impact: $353,000
Hinkal Protocol - 03/07/2026
Type: Contract Logic Flaw
Hinkal Protocol, a zero-knowledge privacy protocol, suffered an exploit stemming from a flaw in its contract logic. The attacker took assets including USDC and ETH across activity touching Ethereum, Bitcoin and THORChain, and subsequently routed proceeds through Tornado Cash to obscure the trail. The incident is a reminder that privacy-focused infrastructure is not inherently secure infrastructure; a logic error in the contract layer exposed funds regardless of the protocol's privacy design.
Impact: $830,000
Summer Finance - 06/07/2026
Type: Flash Loan Attack
Summer Finance, a DeFi yield optimisation protocol, was drained in a flash loan attack. The attacker borrowed a large, uncollateralised sum within a single transaction, used it to distort the protocol's internal state or pricing, and extracted value before repaying the loan in the same atomic transaction. The losses, involving USDC and DAI on Ethereum, were severe enough that the protocol subsequently began winding down operations.
Impact: $6,000,000
Bonk Inu - 07/07/2026
Type: Access Control Exploit
An access-control failure affecting the BONK DAO and its treasury allowed an attacker to reach privileged functionality that should have been restricted. Once able to act with elevated permissions, the attacker moved treasury assets to addresses under their control, later laundering a portion of the proceeds through Tornado Cash. At $21 million, this was one of the largest single losses of the month and among the clearest examples of privileged access, rather than protocol logic, being the point of failure.
Impact: $21,000,000
Bonzo Lend - 11/07/2026
Type: Suspected Oracle Price Manipulation
Bonzo Lend, a DeFi lending platform operating across Hedera and Ethereum, suffered a suspected oracle price manipulation attack. By distorting the price data the protocol relied on to value collateral, the attacker was able to borrow or withdraw more than their deposited position should have allowed, draining assets including SAUCE, ETH and WBTC. Proceeds were subsequently moved through Tornado Cash.
Impact: $5,250,000
Lumi Finance - 13/07/2026
Type: Smart Contract Exploit
Lumi Finance, a DeFi protocol on Arbitrum, experienced a smart contract exploit resulting in the theft of ERC-20 tokens. The attacker leveraged a vulnerability in the protocol's contract code to move assets without authorisation.
Impact: $264,000
Cascade xyz - 15/07/2026
Type: Market Price Manipulation
Cascade, a derivatives DEX on Arbitrum, was targeted in a market price manipulation attack. The attacker manipulated on-chain prices to create artificial profit conditions, then extracted value from the protocol at the expense of its liquidity.
Impact: $1,340,000
Ostium Public OLP Vault - 15/07/2026
Type: Oracle Exploit / Compromised Signer Credentials
On the same day, the Arbitrum-based real-world-asset perpetual protocol Ostium suffered one of the month's largest DeFi exploits. Rather than a code bug, the attacker compromised credentials for an authorised oracle-signer and keeper role, then submitted fraudulent but validly signed price reports. Using these fabricated feeds, the attacker rapidly opened and closed large positions to generate artificial profits, draining the public OLP (Ostium Liquidity Provider) vault across a series of transactions. Stolen USDC was swapped into ETH and laundered through Tornado Cash. Initial estimates placed losses between $18 million and $23.7 million; subsequent tracking put the total closer to $24 million. Trader collateral and open positions were reported unaffected, and the protocol paused trading in response.
Impact: $24,000,000
DeFi Tuna - 16/07/2026
Type: Smart Contract Exploit
DeFi Tuna, a DeFi protocol operating across Solana and Ethereum, suffered a smart contract exploit affecting assets including USDC and its native TUNA token. The attacker abused a flaw in the protocol's contract logic and subsequently moved proceeds through Tornado Cash.
Impact: $570,000
Allbridge - 20/07/2026
Type: Flash Loan Attack
Allbridge, a cross-chain stablecoin bridge, was hit by a flash loan attack spanning Solana and Ethereum. The attacker used borrowed liquidity within a single transaction to manipulate the conditions the bridge relied on, extracting USDC and USDT before repaying the loan.
Impact: $1,650,000
Wanchain - 21/07/2026
Type: Smart Contract Exploit
Wanchain, a cross-chain stablecoin bridge, experienced a smart contract exploit involving activity across Cardano and BNB Smart Chain and assets including NIGHT and ADA. The attacker leveraged a vulnerability in the bridge's contract logic to withdraw assets without corresponding legitimate deposits, one of several bridge-related incidents during the month.
Impact: $10,000,000
Flashtrade - 21/07/2026
Type: Third-Party SDK Validation Flaw
Flashtrade, a perpetuals and derivatives exchange on Solana, suffered an exploit traced to a validation flaw in a third-party SDK it had integrated. The vulnerability sat not in Flashtrade's own core code but in an external software component it depended upon, illustrating how integration and dependency risk can expose a protocol. The platform halted the affected operations, and stated that users were not expected to lose funds.
Impact: $98,000
42DAO - 22/07/2026
Type: Price Oracle Manipulation
42DAO, a DeFi lending and collateralised-debt stablecoin protocol on BNB Smart Chain, was drained via price oracle manipulation. By distorting the price feed used to value collateral (assets included BTCB and BLC), the attacker extracted more value than their position warranted.
Impact: $915,000
AFX Bridge - 22/07/2026
Type: Private Key Leakage (Validator Signing Keys)
AFX Trade, an Arbitrum-based perpetuals DEX, lost approximately $24.15 million after an attacker compromised the validator signing keys behind a bridge the protocol operated itself. The bridge ran a seven-validator multi-signature scheme requiring roughly a two-thirds quorum; the attacker obtained the keys for five validators, comfortably exceeding the threshold, and authorised a withdrawal of USDC to their own address. Notably, the smart contract behaved exactly as designed, verifying legitimate signatures and releasing funds; the compromise was entirely off-chain. The attacker bridged the stolen USDC to Ethereum and swapped it into roughly 12,467 ETH, nearly emptying the protocol's total value locked. Arbitrum's native bridge was not affected. AFX subsequently offered the attacker a 30% white-hat bounty in exchange for returning the balance.
Impact: $24,150,000
Solido Cash - 23/07/2026
Type: Oracle Exploit
Solido Cash, a DeFi lending and stablecoin protocol on the Supra network, suffered an oracle exploit affecting its SOLID, CASH and SUPRA assets. The attacker manipulated or abused the protocol's price feed to extract funds.
Impact: $73,400
Verus - Ethereum Bridge - 23/07/2026
Type: Smart Contract Exploit
The Verus-Ethereum bridge experienced a smart contract exploit affecting a wide range of assets, including ETH, tBTC, USDC, USDT, DAI, EURC, MKR, scrvUSD and VRSC. The attacker abused a flaw in the bridge's cross-chain validation logic to withdraw assets without corresponding legitimate deposits. The Verus-Ethereum bridge had previously been exploited in May 2026, underscoring how bridge infrastructure can remain an attractive target across multiple incidents.
Impact: $7,540,000
Triple-A - 24/07/2026
Type: Hot Wallet Compromise
Triple-A, a licensed crypto payment institution, suffered a hot wallet compromise spanning an unusually broad set of networks, including Ethereum, TRON, Polygon, Arbitrum, Solana, TON and Bitcoin. An attacker gained access to operational wallets used by the institution and moved funds to addresses under their control. This incident is particularly notable because the victim was a regulated payment institution rather than a DeFi protocol, a reminder that operational wallet security is a critical exposure for regulated entities and not only for decentralised platforms.
Impact: $11,800,000
Lien Finance - 24/07/2026
Type: Smart Contract Exploit
Lien Finance, a derivatives protocol on Ethereum, suffered a smart contract exploit affecting USDC. The attacker leveraged a vulnerability in the protocol's contract code to move assets without authorisation.
Impact: $542,000
Projekt - 25/07/2026
Type: Flash Loan Attack
Projekt, a DeFi reward protocol on Ethereum, was drained in a flash loan attack affecting its GREEN, GOLD and WETH assets. The attacker used uncollateralised borrowed liquidity within a single transaction to manipulate the protocol's state before extracting value.
Impact: $560,000
Bankrbot - 25/07/2026
Type: Account Compromise
Bankrbot, an AI-driven crypto trading platform on Base, suffered an account compromise resulting in the theft of its BNKR token. The incident reflects an emerging risk surface, as automated and AI-agent trading platforms introduce new operational accounts and access points that attackers can target.
Impact: $479,000
ChainConnect - 26/07/2026
Type: Unauthorised Access
ChainConnect, a cross-chain bridge spanning Ethereum, BNB Smart Chain, Polygon and Avalanche, suffered an incident stemming from unauthorised access. An attacker gained entry to systems or accounts controlling protocol funds and moved assets to their own addresses.
Impact: $650,000
Garden Finance - 26/07/2026
Type: Supply Chain Attack
Garden Finance, a cross-chain swap and bridge infrastructure provider, was compromised through a supply chain attack. Rather than exploiting Garden's own contracts directly, the attacker compromised a dependency or component within the software supply chain that Garden relied upon, then used that foothold to reach the protocol. Assets affected included USDT, cbBTC, WBTC and dlcBTC across Ethereum, Base, Arbitrum and BNB Smart Chain. Supply chain attacks are especially insidious because the malicious code enters through trusted, otherwise-legitimate channels.
Impact: $450,000
WEMIX - 26/07/2026
Type: Private Key Leakage
WEMIX, a layer-1 blockchain ecosystem and stablecoin protocol, suffered a private key leakage affecting its WEMIX, WEMIX$ and USDC.e assets on WEMIX3.0. With access to the compromised key, the attacker was able to move funds directly, another instance of the month's dominant theme of key compromise over code exploitation.
Impact: $6,250,000
Lula - 28/07/2026
Type: Price Manipulation Attack
Lula, a DeFi token project on BNB Smart Chain, was targeted in a price manipulation attack affecting its LULA token and USDT. The attacker manipulated on-chain pricing to extract value from the project's liquidity.
Impact: $578,100
Crypto DAO - 28/07/2026
Type: Smart Contract Exploit
Crypto DAO, a DeFi token project on BNB Smart Chain, suffered a smart contract exploit affecting its PRO token and USDT. The attacker abused a flaw in the project's contract logic to withdraw assets.
Impact: $52,000
Swan Treasury - 30/07/2026
Type: Private Key Leakage
Swan Treasury, a DeFi and token-sale protocol on BNB Smart Chain, suffered a private key leakage affecting its STY token and USDT. The attacker used the compromised key to move funds to addresses under their control.
Impact: $625,000
Set Control - 30/07/2026
Type: Smart Contract Exploit
Set Control, a DeFi protocol on Ethereum, experienced a smart contract exploit affecting WETH and its bhSET asset. The relatively small loss reflects the limited value held in the affected contract rather than any difference in method.
Impact: $9,600
Coldcard (Coinkite) - 30/07/2026
Type: Firmware Vulnerability (Weak Seed Generation)
The month closed with the single most damaging and instructive incident: the exploitation of a five-year-old firmware flaw in Coinkite's Coldcard, one of the most trusted Bitcoin hardware wallets. A March 2021 firmware build (version 4.0.x) routed seed-phrase generation through a weak software pseudo-random number generator seeded from predictable values, rather than the device's dedicated hardware random-number generator. This reduced effective key strength to as little as 40 bits, low enough for attackers to reconstruct affected seed phrases offline, without malware, phishing, or any physical access to the device.
Beginning on 30 July, attackers swept Bitcoin from affected wallets in a series of waves. The first sweep alone moved more than 1,000 BTC from over a thousand addresses in roughly 40 minutes, and subsequent waves continued into early August, ultimately affecting more than 5,200 addresses. Critically, updating the firmware does not repair a seed that was already generated weakly; affected users must migrate funds to an entirely new seed. This was the third-largest crypto hack of 2026 and the largest hardware-wallet exploit on record, striking directly at the self-custody model long promoted as the safest way to hold Bitcoin.
Impact: ~$116,000,000
Key Findings and Trends
The Coldcard exploit reshaped the month's loss profile
A single incident defined July. The Coldcard firmware exploit accounted for roughly $116 million of the month's approximately $242 million in losses, and did so through a mechanism entirely distinct from the rest of the dataset. Where most incidents targeted protocols, bridges or operational wallets, Coldcard exploited a flaw baked into the very process of key creation on a trusted device. It is a reminder that security failures can be latent for years, that "cold storage" is only as strong as the firmware that generated the seed, and that the most catastrophic losses increasingly originate outside smart contract code altogether.
Compromised keys, seeds and privileged access drove most losses
Excluding pure market and oracle manipulation, the largest share of July's losses traced back to compromised keys, credentials and privileged access rather than flaws in protocol logic. The Coldcard seed-generation flaw, the AFX Bridge validator-key compromise, the Triple-A hot wallet breach, the WEMIX and Swan Treasury private-key leakages, the BONK DAO access-control failure, the Bankrbot account compromise and the ChainConnect unauthorised access together represent the overwhelming majority of funds stolen during the month. As smart contract auditing continues to mature, attackers are concentrating on the operational and off-chain layer: the keys, seeds, signers and administrative accounts that authorise the movement of funds.
Oracle and price manipulation formed a persistent attack cluster
Measured by frequency, the most common attack type in July was the smart-contract or logic exploit, accounting for 9 of the 28 incidents (32%). Behind it came compromised keys, credentials and privileged access (7 incidents, 25%) and oracle or price manipulation (6 incidents, 21%). Together these three families made up 22 of the month's 28 incidents, roughly four in five.
What frequency does not capture is scale. The smart-contract exploits were common but mostly small: six of the nine came in under $600,000, and the category averaged around $2.2 million per incident only because of two larger bridge-related hits (Wanchain at $10 million and the Verus-Ethereum bridge at $7.5 million). For a compliance or security team, this is the everyday, high-volume threat, the kind of incident that fills an alert queue, but individually it rarely accounts for the largest losses.
Measured by value, the picture inverts. The most damaging failures in July were not flaws in protocol logic but compromised keys, seeds, credentials and privileged access. The Coldcard seed-generation flaw alone accounted for roughly $116 million, close to half of the month's approximately $242 million in losses. Add the AFX Bridge validator-key compromise, the Triple-A hot wallet breach, the WEMIX and Swan Treasury private-key leakages, the BONK DAO access-control failure, the Bankrbot account compromise and the ChainConnect unauthorised access, and this family reaches roughly $181 million, about three-quarters of all funds stolen during the month.
By contrast, the smart-contract and logic exploits that were most frequent accounted for only around $20 million, or 8% of losses, the fourth-largest category by value despite being the largest by count. Concentration was extreme at the top: the five largest incidents (Coldcard, AFX Bridge, Ostium, BONK DAO and Triple-A) together represent roughly $197 million, about 81% of the month's total. As smart-contract auditing continues to mature, the most expensive attacks are migrating to the operational and off-chain layer: the keys, seeds, signers and administrative accounts that authorise the movement of funds.
Cross-chain bridges remained a favoured target
Continuing a trend seen throughout 2026, cross-chain bridges and interoperability infrastructure were repeatedly targeted, including Allbridge, Wanchain, AFX Bridge, the Verus-Ethereum bridge, ChainConnect and Garden Finance. Bridges concentrate significant locked value and depend on complex verification, signing and validation arrangements, each of which introduces additional trust assumptions and potential points of failure. The Verus-Ethereum bridge, exploited again in July after a May incident, illustrates how the same infrastructure can be revisited by attackers.
Ethereum led targeted chains; stablecoins led stolen assets
As in previous months, Ethereum featured in more incidents than any other network, reflecting its central role as the settlement layer for DeFi, stablecoins, wrapped assets and cross-chain infrastructure. BNB Smart Chain and Arbitrum also appeared frequently. On the asset side, the stablecoins USDC and USDT were once again the most commonly stolen assets, prized by attackers for their liquidity and resistance to price volatility, while Bitcoin dominated by value on the strength of the Coldcard incident alone.
Tornado Cash remained the laundering venue of choice
Across the month, Tornado Cash reappeared as the primary laundering venue for stolen funds, featuring in the post-exploit flows of the Hinkal, BONK DAO, Bonzo Lend, Ostium and DeFi Tuna incidents, among others. The recurring pattern, converting stolen assets into ETH before routing them through a mixer, remains the standard obfuscation playbook, and a standing reminder of why on-chain attribution and transaction monitoring matter once funds begin to move.
Regulatory and Compliance Developments
Beyond the exploits themselves, July 2026 brought a cluster of regulatory developments across three very different markets. Taken together, they point to the same underlying shift: crypto oversight is no longer a question of whether rules exist, but of whether firms can actually detect, monitor and act on illicit activity.
FATF: legislation is spreading faster than enforcement
In its Seventh Targeted Update on the implementation of standards for virtual assets and virtual asset service providers (VASPs), the Financial Action Task Force reported that 83% of surveyed jurisdictions have now passed legislation to implement the Travel Rule, up from 73% in 2025. The Travel Rule requires VASPs to collect and transmit originator and beneficiary information for qualifying transfers, so that intermediaries know who is sending and receiving funds across regulated platforms.
The more revealing figure was on enforcement: according to the update, only around 40% of jurisdictions with Travel Rule legislation have taken meaningful supervisory or enforcement action. FATF framed this gap as the core problem, noting the "weakest-link" nature of a global system in which illicit actors simply route activity through the jurisdictions least able or willing to police it. The report specifically flagged organised-crime-linked scam centres, DPRK-linked cyber theft, DeFi, unhosted wallets and freeze-resistant stablecoins as areas of growing concern, precisely the categories that static, list-based screening struggles to capture.
South Korea: a long-delayed crypto gains tax set for 2027
South Korea signalled that it intends to begin taxing cryptocurrency gains from 1 January 2027, declining to postpone the measure for a fourth time. Under the framework described by the National Tax Service, annual crypto gains above 2.5 million won (roughly $1,740) would be taxed at a combined rate of up to 22%. The tax was originally due in 2022, was pushed to 2025, and then delayed again to 2027.
Critics, including opposition lawmakers, warned that the absence of loss carry-forward provisions could dampen domestic demand and push investors toward offshore centralised exchanges, decentralised platforms and peer-to-peer markets. That migration risk, funds and users moving to venues with weaker oversight, is the same dynamic FATF describes at a global level.
Vietnam: a first penalty framework with KYC teeth
Vietnam introduced its first administrative penalty framework for crypto-asset violations under Decree No. 284/2026/ND-CP, signed on 16 July and taking effect from 1 September. Domestic investors using platforms not licensed by the Ministry of Finance face fines of roughly VND30–50 million (about $1,140–$1,900), with steeper penalties for using assets reserved for foreign investors, and fines of up to VND180–200 million for firms providing or marketing crypto services without a licence.
Most significant from a compliance standpoint: service providers that fail to verify customer identities when opening accounts face fines of VND50–70 million, hard-coding KYC obligations into the penalty regime. The decree sits within Vietnam's five-year pilot market, in a country that ranked fourth in Chainalysis' 2025 Global Crypto Adoption Index, making it one of the fastest-growing crypto markets in the world.
Why this reinforces the case for compliance, KYT and the intelligence layer
Three jurisdictions, three very different stages of market maturity, and one consistent direction of travel. A high-adoption developed market (South Korea) is formalising tax enforcement; a global standard-setter (FATF) is shifting its scrutiny from whether rules exist to whether they are enforced; and a fast-growing emerging market (Vietnam) is building a penalty regime with explicit KYC requirements. For any VASP, exchange, custodian or payment institution operating across borders, the compliance perimeter is expanding and hardening at the same time.
The FATF finding is the one compliance teams should sit with. When 83% of jurisdictions have the Travel Rule on the books but only 40% enforce it, the burden shifts decisively onto firms to demonstrate that their monitoring actually works. A rule that sits unenforced does not protect a business; a regulator arriving after an incident will ask what the firm saw, when it saw it, and what it did. Answering that requires more than a policy document.
It also requires more than KYC. Verifying a customer's identity at onboarding, now a finable obligation in Vietnam, tells a firm who opened an account. It does not tell them what those funds did before they arrived or where they go afterwards. That is the role of Know Your Transaction (KYT): continuous, behaviour-aware monitoring of the flows in and out of an account, not a one-time identity check at the door.
And KYT itself is only as strong as the intelligence behind it. The risks FATF singled out, DeFi, unhosted wallets, freeze-resistant stablecoins, scam centres and state-linked theft, are exactly the exposures that a static sanctions-list check will miss. The incidents documented earlier in this report make the point concretely: funds were converted to ETH and pushed through Tornado Cash, moved across multiple chains, and, in the Coldcard case, pooled at consolidation addresses before dispersal. A wallet involved in any of these flows can be entirely absent from a sanctions list and still sit one or two hops from stolen or illicit funds. Catching that requires an intelligence layer capable of attribution, wallet clustering, cross-chain tracing and behavioural analysis, the ability to see the network around an address rather than only the address itself.
This is the throughline connecting July's exploits and July's regulation. Attackers are exploiting keys, seeds and cross-chain complexity, then laundering through mixers and across jurisdictions. Regulators are responding by demanding not just rules but enforcement. The firms that stay ahead of both will be those that treat compliance as an operational, intelligence-driven capability, screening wallets, monitoring transactions and understanding the networks behind them, rather than a box-ticking exercise against a static list.
Conclusion
July 2026 delivered approximately $242 million in losses across 28 major incidents, making it one of the heaviest months of the year. Yet the headline figure is less instructive than its composition. A single hardware-wallet firmware flaw accounted for close to half of the total, while the majority of the remaining losses stemmed not from broken code but from compromised keys, seeds, credentials and privileged access.
The through-line is clear. The crypto threat landscape is continuing to shift away from isolated smart contract vulnerabilities and toward the operational, human and infrastructural layers that surround the code: the process that generates a seed, the keys that sign a bridge withdrawal, the credentials that authorise an oracle report, the operational wallets of a regulated payment institution. These are not exotic, novel attack surfaces; they are the everyday trust relationships that the ecosystem depends upon to function.
For compliance teams, custodians and protocol operators, the implication is that code audits alone are no longer sufficient. Operational resilience, key and seed management, signer and credential hygiene, dependency and supply-chain review, and continuous monitoring of privileged accounts and post-exploit fund flows are now central to managing crypto risk. As the Coldcard incident demonstrated, a vulnerability introduced years ago can surface without warning and at devastating scale, and the difference between exposure and safety increasingly lies in what an organisation can see, verify and act upon before funds move.
All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.
.png)