Coldcard Exploit Drives July Crypto Losses to $247 Million, Second-Worst Month of 2026

July ranked as the second-worst month for cryptocurrency theft in 2026, with total losses reaching $247.4 million, driven largely by the ongoing Coldcard hardware wallet exploit.

July Losses Triple Prior Months

According to DefiLlama data, the $247.4 million stolen in July trails only April’s $644 million as the worst month this year. The total was more than triple June’s $75 million and May’s $60 million in losses, marking a sharp escalation in crypto theft activity.

Coldcard Remains the Biggest Culprit

The Coldcard exploit stood out as July’s largest single incident, with Galaxy Digital estimating at least $100 million in Bitcoin stolen from 7,300 wallets across three confirmed attack waves. A suspected fourth wave could push total losses to around $130 million, while DefiLlama’s tracker estimates Coldcard-related losses at $115 million.

Other Notable July Incidents

Additional exploits during the month included a $9 million hack on DeFi protocol Bonzo Lend, $2.6 million stolen from Cardano-based wallet SecondFi, $24 million taken from Arbitrum-based exchange AFX, and $7.5 million lost through the Verus Ethereum Bridge.