Coldcard Exploit Drives July Crypto Losses to $247M, Marking Second-Worst Month of 2026
Key Takeaways
- •July 2026 saw $247.4 million in cryptocurrency stolen, making it the second-largest theft month of the year after April's $644 million.
- •The Coldcard hardware wallet exploit affected approximately 7,300 wallets and resulted in at least $100 million in Bitcoin stolen across three confirmed attack waves.
- •Galaxy Digital identified a suspected fourth Coldcard attack wave that could raise total losses to roughly $130 million.
- •Additional July exploits included a $24 million attack on Arbitrum-based AFX, a $9 million hack of Bonzo Lend, and smaller thefts from the Verus Ethereum Bridge and SecondFi.
- •The diversity of attacks across Layer 2 platforms, cross-chain bridges, and non-EVM ecosystems underscores that no network or custody approach has proven fully resistant to exploitation.
The Coldcard hardware wallet exploit was the primary driver behind $247.4 million in cryptocurrency stolen during July, making it the second-worst month for crypto thefts in 2026, according to DefiLlama data.
July's losses trailed only April, when hackers stole $644 million. The monthly total was more than triple the $75 million stolen in June and well above the $60 million taken in May. The first seven months of 2026 have now produced multiple nine-figure theft months, underscoring a sustained escalation in attack scale even as the industry invests heavily in security infrastructure.
Coldcard Exploit: The Month's Largest Attack
The Coldcard exploit dominated July's theft landscape. At least $100 million in Bitcoin (BTC) was stolen from approximately 7,300 wallets across three confirmed attack waves, according to Galaxy Digital. The firm also identified a suspected fourth attack wave that could raise total losses to roughly $130 million. DefiLlama's hack tracker independently estimates Coldcard-related losses at $115 million.
Coldcard devices are marketed specifically for offline Bitcoin storage and have been widely recommended by self-custody advocates as one of the more secure options for holding private keys. The fact that a hardware wallet designed to keep keys air-gapped was compromised across thousands of units simultaneously represents a notable breach of a security model long trusted by experienced users.
"July showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously," research platform CryptoRank said in a Thursday X post.
Other Notable July Exploits
Several additional attacks contributed to July's losses, spanning multiple blockchains and attack vectors:
- A $24 million exploit targeting Arbitrum-based perpetual exchange AFX
- A $9 million hack against decentralized finance protocol Bonzo Lend
- $7.5 million stolen through the Verus Ethereum Bridge
- $2.6 million taken from Cardano-based wallet SecondFi
The geographic and protocol diversity of July's attacks—from Layer 2 derivatives platforms to cross-chain bridges to non-EVM ecosystems like Hedera and Cardano—illustrates that no single network or custody approach has proven immune to exploitation this year.