Cryptocurrency Hack Losses Climb 177% to $210.3 Million in July, Ranking as 2024's Third-Worst Month

Losses from cryptocurrency-related hacks reached $210.3 million in July, marking a 177% increase from the $75.87 million recorded in June, according to the latest industry data. The surge, distributed across 30 separate incidents, underscores the persistent security challenges confronting the digital asset ecosystem despite ongoing advances in protocol-level defenses.

Major Incidents Drive Monthly Toll

A small number of high-profile breaches accounted for the bulk of July's losses. The top five incidents alone were responsible for over $150 million of the total.

The largest single event was the Coldcard Wallet compromise, which resulted in approximately $70 million in losses. The incident ranked as the third-largest of the year and drew attention to vulnerabilities in hardware wallet security—a segment of the industry previously regarded as among the most resilient. Hardware wallets, which store private keys on offline devices, have long been recommended as a best practice for self-custody, making a breach at this level particularly notable for users who relied on such devices as their primary line of defense.

Other significant attacks included exploits targeting the Arbitrum-based protocol AFX and the decentralized derivatives platform Ostium, each of which lost roughly $24 million. A system associated with the Bonk memecoin lost $21.2 million, while the Wanchain Bridge suffered a $13 million cross-chain attack. Cross-chain bridges have been a recurring vulnerability since 2022, when several of the largest crypto hacks in history involved bridge exploits—a pattern that has persisted even as the broader industry has matured. The concentration of July's incidents on bridges and DeFi protocols reflects a broader trend in which attackers target infrastructure that holds substantial pools of liquidity.

Year-to-Date Losses Exceed $1.2 Billion

July's figures bring the 2024 year-to-date total to over $1.2 billion, a level that has already surpassed the full-year totals for both 2022 and 2023. With five months remaining in the year, the trajectory places 2024 on pace to rank among the worst years on record for cryptocurrency-related theft. The sustained volume of losses signals that while certain security practices have improved, the overall attack surface continues to expand as new projects and token launches enter the market.

The increase in losses coincides with a period of heightened market activity, with Bitcoin and other major cryptocurrencies trading near record highs. Such an environment tends to attract both legitimate investors and malicious actors, as the potential payoff from high-value thefts grows in tandem with market capitalization.

Industry and User Implications

The diversity of attack vectors observed in July—from hardware wallet vulnerabilities to smart contract exploits—illustrates that no single security measure is sufficient on its own. Security professionals within the industry commonly recommend that users diversify storage methods, employ multi-signature wallets for large holdings, and remain attentive to the security posture of the platforms they interact with.

At the industry level, the persistent losses underscore the need for more rigorous security standards, particularly for cross-chain bridges and newly launched protocols that are frequently targeted within days of going live. The recurring exploitation of bridges specifically has prompted growing discussion within the developer community about whether the architectural trade-offs that make bridges convenient for moving assets between blockchains also make them structurally difficult to secure.

Evolving Threat Landscape

While the cryptocurrency sector has made progress in areas such as insurance coverage and bug bounty programs, the scale and sophistication of attacks continue to advance. Among the most frequently targeted categories are cross-chain bridges, DeFi protocols, and recently launched projects, where attackers typically exploit vulnerabilities in smart contracts or compromised private keys.