Galaxy

Security

Nothing

random

<ul><li><strong>July crypto losses climbed to $210.3 million across 30 recorded incidents.</strong></li><li><strong>The COLDCARD firmware flaw became the third-largest crypto theft of the year.</strong></li><li><strong>The biggest exploits hit hardware, developer machines and oracles rather than smart contract code.</strong></li><li><strong>AFX Trade offered its attacker a share of the stolen funds to return the rest.</strong></li></ul><p><strong><a href="https://x.com/PeckShieldAlert/status/2083388287688049084" rel="noopener noreferrer nofollow">PeckShield’s July 2026 report</a></strong> puts crypto losses at $210.3 million across 30 separate hacks, a 177.2% jump from the $75.87 million stolen in June. The month’s damage did not come from the kind of smart contract bug that audits are built to catch. It came from a hardware wallet’s firmware, a developer tricked by a fake job offer, a price oracle fed fake timestamps, and a governance vote bought on the open market. Four incidents accounted for most of the total, which fits a pattern security firms have been flagging all year: fewer attacks, and far more surgical ones.</p><div style="margin: 28px 0; font-family: inherit;"><p style="margin: 0 0 16px; font-weight: bold; font-size: 17px; color: #0b1e3a;">Where July’s $210.3M went</p><div style="display: flex; flex-direction: column; gap: 11px;"><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">COLDCARD</span><span style="font-weight: bold; color: #dc2626;">$70M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 100%; height: 22px; background: linear-gradient(90deg,#dc2626,#f97316); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">AFX Trade</span><span style="font-weight: bold; color: #ea580c;">$24.15M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 34.5%; height: 22px; background: linear-gradient(90deg,#ea580c,#f59e0b); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Ostium</span><span style="font-weight: bold; color: #ea580c;">$23.75M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 33.9%; height: 22px; background: linear-gradient(90deg,#ea580c,#f59e0b); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">BONK</span><span style="font-weight: bold; color: #d97706;">$20M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 30.3%; height: 22px; background: linear-gradient(90deg,#d97706,#eab308); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Wanchain</span><span style="font-weight: bold; color: #0d9488;">$13M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 18.6%; height: 22px; background: linear-gradient(90deg,#0d9488,#22c55e); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Triple-A</span><span style="font-weight: bold; color: #0d9488;">$10M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 14.3%; height: 22px; background: linear-gradient(90deg,#0d9488,#22c55e); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Bonzo Lend</span><span style="font-weight: bold; color: #0891b2;">$9.05M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 12.9%; height: 22px; background: linear-gradient(90deg,#0891b2,#06b6d4); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Verus</span><span style="font-weight: bold; color: #0891b2;">$7.5M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 10.7%; height: 22px; background: linear-gradient(90deg,#0891b2,#06b6d4); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">Wemix Network</span><span style="font-weight: bold; color: #4f46e5;">$6.25M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 8.9%; height: 22px; background: linear-gradient(90deg,#4f46e5,#818cf8); border-radius: 6px;"></div></div></div><div><div style="display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 4px;"><span style="font-weight: 600; color: #111827;">summer.finance</span><span style="font-weight: bold; color: #4f46e5;">$6M</span></div><div style="background: #eef1f6; border-radius: 6px; overflow: hidden;"><div style="width: 8.6%; height: 22px; background: linear-gradient(90deg,#4f46e5,#818cf8); border-radius: 6px;"></div></div></div></div><p style="font-size: 12px; color: #6b7280; margin: 14px 0 0;">Bar length scaled to the largest loss. Estimates from PeckShield, Blockaid and Halborn.</p></div><h2 style="color: #0f2140;" id="strong-the-coldcard-sweep-drained-30-million-in-ten-minutes-strong"><strong>The COLDCARD sweep drained $30 million in ten minutes</strong></h2><p><strong><a href="https://blog.coinkite.com/coldcard-mk3-seed-generation-warning" rel="noopener noreferrer nofollow">Coinkite’s COLDCARD hardware wallet </a></strong>accounted for roughly $70 million of July’s losses by PeckShield’s count, a figure that lines up with Galaxy Research tracing about 1,083 BTC across 1,196 addresses, though Chainalysis has so far confirmed a narrower on-chain sweep of around $38 million. Even at the lower figure it ranks third&nbsp;among all crypto thefts recorded this year, behind the Drift and KelpDAO/LayerZero exploits. The problem sat in the firmware. The device’s true random number generator was bypassed and quietly fell back to a predictable software source, which cut the entropy behind seed generation on the affected Mk3 devices from the expected 128 bits down to roughly 40. At that level, keys stop being practically unguessable and become something a well-resourced attacker can reconstruct through brute force.</p><p>The sweep on July 30 and 31 was fast and rehearsed. Chainalysis reported that the attacker <strong><a href="https://x.com/chainalysis/status/2083258384396996713" rel="noopener noreferrer nofollow">had already mapped which wallets</a></strong> held the most value and went after the largest single-signature balances first, pulling around $30 million in the opening ten minutes. Self-custody rests on one assumption, that the cryptography running on the device is sound. A user here could keep the seed offline, verify every address and follow every rule, and still lose the wallet, because the flaw lived below anything they could control.</p><h2 style="color: #0f2140;" id="strong-afx-trade-lost-control-of-its-bridge-through-a-fake-job-offer-strong"><strong>AFX Trade lost control of its bridge through a fake job offer</strong></h2><p>AFX Trade, a perpetuals protocol on Arbitrum, lost $24.15 million after one of its developers was targeted by a fake recruiter. Posing as a hiring manager from a firm called Oddium Lab, the attacker got the developer to clone what looked like a legitimate code repository on July 9. The repo carried a malicious Git configuration that ran a hidden payload during a routine workflow, handing the attacker a foothold on the machine. Nothing about the Arbitrum network itself failed. <strong><a href="https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised" rel="noopener noreferrer nofollow">Offchain Labs co-founder Steven Goldfeder</a></strong>was quick to point out that the Layer-2’s base layer stayed secure throughout, and the same held for Ostium, which runs on the same network. The breach happened on the developer’s own machine.</p><p>Once inside the development environment, the attacker pulled the keys behind the bridge’s hot validators. Five validator signatures were enough to meet the roughly two-thirds threshold the bridge required, so the smart contract read the withdrawal as entirely legitimate and executed it on command. Nothing had to be broken. AFX Trade then did what a growing number of protocols now do after a breach: it offered the thief a 30% bounty worth about $7.2 million in exchange for returning the other 70%.</p><h2 style="color: #0f2140;" id="strong-how-ostium-s-attacker-wrote-bitcoin-down-to-5-000-strong"><strong>How Ostium’s attacker wrote Bitcoin down to $5,000</strong></h2><p>Ostium’s $23.75 million loss came from its price feed. The attacker got hold of a private signing key for one of the platform’s oracles and pushed future-dated timestamps through a registered forwarder called PriceUpKeep. That let them write a false Bitcoin price of $5,000 into the contract, open heavily leveraged positions against that fiction, and then settle them at the real market price near $60,000. The gap became pure profit, paid out of the platform’s liquidity vault to positions that never earned it.</p><p><strong><a href="https://www.halborn.com/blog/post/explained-the-ostium-hack-july-2026" rel="noopener noreferrer nofollow">Halborn Security noted</a></strong> a detail that turned a vulnerability into an open door. The PriceUpKeep infrastructure had been left out of Ostium’s active bug bounty scope. White-hat researchers had no incentive to look at it, so nobody did, and the attacker walked an unwatched path straight to the price feed.</p><h2 style="color: #0f2140;" id="strong-bonk-dao-voted-its-own-treasury-away-strong"><strong>BONK DAO voted its own treasury away</strong></h2><p>The BONK DAO incident on Solana skipped the code entirely. There was no bug to exploit. The attacker spent about $4 million buying BONK on exchanges, then used that stake to control almost the entire vote. Turnout was so thin that wallets tied to the attacker made up roughly 99.9% of the votes cast, and the proposal moving about $20 million of treasury tokens to their own wallet passed cleanly. Every step was valid under the DAO’s own rules. The theft was legal in the narrow sense that the protocol worked exactly as written.</p><div style="margin: 28px 0; font-family: inherit; display: grid; grid-template-columns: repeat(auto-fit,minmax(240px,1fr)); gap: 16px;"><div style="background: #fff; border-radius: 12px; border: 1px solid #f0d5d5; border-top: 4px solid #dc2626; padding: 18px 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.05);"><div style="font-size: 12px; font-weight: bold; letter-spacing: 0.5px; color: #dc2626; text-transform: uppercase;"> Wallet firmware </div><div style="font-size: 22px; font-weight: 800; color: #0b1e3a; margin: 6px 0 2px;"> COLDCARD · $70M </div><p style="margin: 8px 0 0; font-size: 14px; line-height: 1.55; color: #374151;">The random number generator was bypassed, entropy on the drained Mk3 devices fell to about 40 bits, and private keys became reconstructible by brute force.</p></div><div style="background: #fff; border-radius: 12px; border: 1px solid #f3ddc5; border-top: 4px solid #ea580c; padding: 18px 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.05);"><div style="font-size: 12px; font-weight: bold; letter-spacing: 0.5px; color: #ea580c; text-transform: uppercase;"> Developer machine </div><div style="font-size: 22px; font-weight: 800; color: #0b1e3a; margin: 6px 0 2px;"> AFX Trade · $24.15M </div><p style="margin: 8px 0 0; font-size: 14px; line-height: 1.55; color: #374151;">A fake recruiter’s malicious repo compromised a developer’s machine; stolen validator signatures cleared a bridge withdrawal the contract read as legitimate.</p></div><div style="background: #fff; border-radius: 12px; border: 1px solid #cce7e3; border-top: 4px solid #0d9488; padding: 18px 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.05);"><div style="font-size: 12px; font-weight: bold; letter-spacing: 0.5px; color: #0d9488; text-transform: uppercase;"> Price oracle </div><div style="font-size: 22px; font-weight: 800; color: #0b1e3a; margin: 6px 0 2px;"> Ostium · $23.75M </div><p style="margin: 8px 0 0; font-size: 14px; line-height: 1.55; color: #374151;">A stolen signing key wrote Bitcoin down to $5,000, opened leverage, and settled near $60,000 out of the liquidity vault.</p></div><div style="background: #fff; border-radius: 12px; border: 1px solid #d5d3f0; border-top: 4px solid #4f46e5; padding: 18px 20px; box-shadow: 0 1px 3px rgba(0,0,0,0.05);"><div style="font-size: 12px; font-weight: bold; letter-spacing: 0.5px; color: #4f46e5; text-transform: uppercase;"> Governance </div><div style="font-size: 22px; font-weight: 800; color: #0b1e3a; margin: 6px 0 2px;"> BONK DAO · $20M </div><p style="margin: 8px 0 0; font-size: 14px; line-height: 1.55; color: #374151;">Attackers bought enough BONK to swing the DAO and passed a proposal that emptied the treasury into their own wallets.</p></div></div><h2 style="color: #0f2140;" id="strong-audits-stopped-being-where-the-money-leaks-strong"><strong>Audits stopped being where the money leaks</strong></h2><p>For years the security conversation centered on smart contract audits, on the assumption that a clean codebase meant a safe protocol. July’s numbers argue otherwise. Web3 security researcher Victor Okpukpan pointed out on X that the large exploits are drifting away from on-chain code and toward key management, developer workspaces and oracle pathways. <strong><a href="https://www.certik.com/skynet-report/certik-hack3d-h1-2026-report" rel="noopener noreferrer nofollow">CertiK’s mid-year report</a></strong>put numbers to the same shift: wallet compromises cost $444.5 million across just 33 incidents in the first half of 2026, overtaking smart contract exploits as the single most expensive attack category, even though code vulnerabilities still produced far more incidents.&nbsp;The four biggest July incidents fit that reading, and none of them required finding a flaw in a deployed contract.</p><h2 style="color: #0f2140;" id="strong-what-a-firmware-flaw-does-to-the-self-custody-case-strong"><strong>What a firmware flaw does to the self-custody case</strong></h2><p>The COLDCARD breach lands hardest on retail holders who chose hardware wallets precisely to avoid trusting anyone else. If a foundational chip or firmware error can undo perfect personal security, the argument for holding your own keys weakens for anyone without the technical depth to audit their own device. That pressure points in one direction for part of the market, toward regulated custodians and spot Bitcoin ETFs, where the security burden sits with an institution rather than the individual.</p><h2 style="color: #0f2140;" id="strong-protocols-now-budget-for-paying-attackers-back-strong"><strong>Protocols now budget for paying attackers back</strong></h2><p>The AFX Trade offer is becoming standard practice rather than an exception. Negotiating the return of stolen funds has moved from rare improvisation into written incident-response plans, and some firms now treat a percentage payout to attackers as a recovery cost. What no one has settled is the legal status of those payments. US and European regulators have not drawn a clear line between a ransom and a lawful settlement, and how they eventually classify a bounty paid to a known thief will decide whether the tactic that saved AFX Trade most of its money stays available to the next protocol that needs it.</p><p>The post <a href="https://ethnews.com/july-crypto-hacks-210m/" rel="noopener noreferrer nofollow">July Crypto Hacks Total $210M, Led by COLDCARD Breach</a> appeared first on <a href="https://ethnews.com" rel="noopener noreferrer nofollow">ETHNews</a>.</p>

July Crypto Hacks Total $210M, Led by COLDCARD Breach

Table of Contents

ETHNews

Other articles published on Aug 1, 2026

Perpetual contracts on tokenized assets explode on Hyperliquid and Binance

Ethereum News Today: BitMine Adds 10K ETH, Validator Queue Hits 2.5M

Crypto’s Biggest Phase Has Begun: 5 Altcoins Worth Buying as the Fed Decision Shapes the Next Bul...

Crypto Mining News: Russia Bans Mining in Moscow, Busts Secret Farms

Solana Pay Expands Into South Korea as KSNet Connects 330,000+ Merchants

Cardano Price Prediction Tests $0.17 Resistance While Whale Wallets Quietly Stack a Different Token

Join our free newsletter for daily crypto updates!