
July crypto thefts hit $247.4M, tripling June's total. The Coldcard exploit alone accounted for at least $100M across 7,300 wallets, with losses still being tallied.
July became the second-worst month of 2026 for cryptocurrency thefts after hackers stole $247.4 million, more than tripling June's $75 million total and far surpassing May's $60 million. The surge was driven primarily by the Coldcard exploit, which accounted for at least $100 million in stolen Bitcoin across 7,300 wallets and three confirmed attack waves. What makes the episode unsettling is that a security product designed for cold storage became the center of the month's largest crypto breach, challenging assumptions that keeping assets offline is enough to neutralize sophisticated technological threats.
In July, losses from cryptocurrency hacks reached $247M, making it the second-largest monthly total since the beginning of the year. One of the main contributors was the incident involving Coldcard hardware wallets.
The scale of the Coldcard incident remains uncertain. Galaxy Digital identified three confirmed attack waves and a suspected fourth that could push total losses to roughly $130 million, while DefiLlama's hack tracker estimated $115 million tied to the exploit. The gap between confirmed and potential losses underscores how difficult it can be to measure damage while an attack is still being reconstructed. CryptoRank said July demonstrated that cold storage does not eliminate technological risk, noting that vulnerabilities can simultaneously place thousands of wallets in danger despite the perception that offline custody offers a defensive boundary.
Coldcard was not the only target. Other notable incidents included a $24 million theft from Arbitrum-based perpetual exchange AFX, a $9 million attack against decentralized finance protocol Bonzo Lend, $7.5 million stolen through the Verus Ethereum Bridge and $2.6 million taken from Cardano-based wallet SecondFi. Together, these incidents show that July's losses were distributed across wallets, DeFi protocols, exchanges and cross-chain infrastructure, even though Coldcard overwhelmingly shaped the monthly total. The diversity of targets also illustrates how attackers continue probing different layers of the crypto ecosystem rather than concentrating on one category.
July's $247.4 million theft total was exceeded this year only by April, when attackers stole $644 million. That comparison places the month well above recent levels, with losses more than three times June's figure and more than four times May's. The numbers reveal how quickly the security picture can deteriorate when one large exploit coincides with several smaller breaches. Coldcard alone represented a substantial share of July's damage, while the additional attacks amplified the final tally. The result leaves 2026 with another unusually severe month for crypto theft and renewed questions about how much protection specialized custody technology can realistically provide.
The disclosure made by Kraken Security Labs in February 2023 exposed a physical vulnerability in the Coldcard Mk4 that enables seed extraction without knowing the PIN. Hackers linked to the Coldcard exploit transferred 64 BTC ($4.17 million) and 200 ETH ($380,000) to crypto mixers. Most of the stolen funds remain untouched. The hacker's wallet, holding around $36 million in stolen bitcoin, has been receiving permanent messages via OP_RETURN since July 30. The notes range from pleas to threats.
For context on how these events fit into the broader market picture, see our crypto market analysis. The Coldcard hack, with an estimated $130 million in losses, also renewed debate over whether institutional custody in Bitcoin ETFs offers safer protection than self-custody.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.