How July’s $210M In Hacks Could Have Been Prevented

Crypto lost $210.3 million to 30 major hacks in July 2026, a 177.2% jump from June’s already troubling $75.87 million, according to PeckShieldAlert’s monthly tally.

I went through the ten biggest incidents individually, and what struck me isn’t just the total. It’s how few of these losses came down to a genuinely novel attack. Almost every one of them exploited a category of weakness the industry has known about for years.

Coldcard’s Entropy Flaw Tops The Chart At $70 Million

The single largest incident of the month came from Coldcard, whose manufacturer Coinkite disclosed a critical entropy-generation flaw affecting Mk2 and Mk3 firmware. The flaw meant seeds generated on affected devices relied on predictable inputs rather than genuine hardware randomness, and losses linked to the exploit have climbed to roughly $70 million, making it the third-largest crypto theft of the year to date, trailing only the Drift Protocol exploit and the KelpDAO/LayerZero incident. Anyone who generated a seed on affected firmware needs to update immediately, generate an entirely new seed, and migrate funds away from anything touched by the old one, since a patch fixes future key generation but does nothing to repair a seed that was already weakened before the fix existed. Coinkite’s security advisory has the full technical breakdown.

Oracles Keep Failing, AFX, Ostium, And Bonzo Lend

Three of July’s ten biggest hacks trace back to the exact same category of failure: a price oracle that got fed false information and paid out based on it. AFX Trade lost roughly $24 million through its Arbitrum-based USDC custody bridge, with the team confirming via its official account that the incident was isolated to that specific bridge rather than its broader trading infrastructure or the Arbitrum network itself.

Ostium, an Arbitrum-based perpetuals exchange, lost a similar amount, roughly $24 million, after an attacker gained access to the private key controlling its price oracle signer. Using a registered PriceUpKeep Forwarder, the attacker submitted authorized but future-dated price reports that Ostium’s contracts accepted as genuine because they carried a valid signature from a trusted source. They opened a position at an artificially manipulated low price and closed it at the real market rate, pocketing the difference, and repeated the cycle with increasingly larger positions before converting the proceeds into ETH and routing most of it through Tornado Cash. What I find most damning here is a detail Ostium’s own post-mortem confirms: the exact component that got exploited, the PriceUpKeep infrastructure, was explicitly excluded from the scope of Ostium’s own bug bounty program, meaning security researchers had no financial incentive to find and report this exact weakness before an attacker did.

Bonzo Lend, Hedera’s largest DeFi lending protocol, lost $9.05 million after an attacker deposited a small amount of SAUCE tokens and submitted a manipulated price update through a third-party Supra oracle contract, inflating the token’s value by roughly twelve orders of magnitude and borrowing millions against essentially worthless collateral. Bonzo was careful to note in its official incident report that its own smart contracts functioned exactly as designed, reading the price the oracle handed it. The failure sat entirely in the oracle’s verification layer, not the lending logic itself. I think that distinction matters, but I also think it’s cold comfort to depositors who lost 77% of the protocol’s total value locked in a single day regardless of which specific component technically failed.

When “Decentralized Governance” Becomes The Attack Vector

BonkDAO’s loss is the one I find most conceptually unsettling, because nothing about it involved broken code. An attacker submitted a governance proposal on Solana’s Realms platform that appeared to reward “YES voters,” but contained a hidden clause transferring 4.43 trillion BONK tokens to an attacker-controlled address. The proposal sat live for roughly seven days attracting almost no attention, while the attacker quietly accumulated just over 1% of BONK’s total supply, roughly $4.4 million worth, using exchange wallets, enough to single-handedly clear the DAO’s voting quorum. Near the deadline, they cast one decisive “YES” vote, the proposal passed, and the treasury automatically transferred $21.2 million in BONK to their wallet, turning a $4.4 million position into nearly $17 million in profit without touching a single line of smart contract code.

I think this incident deserves special attention because it exposes a governance design flaw rather than a technical one: a 1% quorum threshold with no timelock meant that anyone with enough capital to briefly buy voting power could legally, mechanically drain a treasury through the DAO’s own normal functioning. Some in the community have genuinely debated whether this constitutes theft at all, given that it followed the DAO’s own rules to the letter. I don’t think that debate changes the outcome for BonkDAO’s treasury, but it does highlight a governance vulnerability that plenty of other token-weighted DAOs still haven’t addressed.

Bridges Keep Bleeding, Wanchain, Verus, And Beyond

Cross-chain bridges had another rough month. Wanchain’s bridge connecting Cardano and BNB Chain lost roughly $13 million in NIGHT tokens after attackers exploited a non-injective signed-message encoding flaw in the bridge’s TreasuryCheck validator, which built signed messages by concatenating 14 variable-length fields without separators or length identifiers, allowing different field combinations to produce an identical signature that could be reused to authorize wildly larger withdrawals than originally approved. One transaction alone amplified an authorization worth roughly 3,110 NIGHT into more than 203 million tokens, a 65,000x multiplication that should never have been mathematically possible. The Midnight Foundation was quick to clarify that its core blockchain, validators, and consensus mechanism were never touched, the failure lived entirely in Wanchain’s third-party bridge code.

The Verus Ethereum Bridge lost roughly $7.5 million in a second exploit since May, using the exact same entry path and bug class as the earlier incident, just executed by a different attacker with a different wallet. I think that repetition is the most damning detail in this entire bridge category. A vulnerability disclosed and supposedly addressed in May resurfacing months later, unpatched at its root cause, tells me the fix applied after the first exploit treated a symptom rather than the actual underlying flaw. Worth flagging: as of this writing, VerusCoin still hasn’t put out any public statement on the July incident, so this one is sourced entirely from the on-chain trace and independent security firms rather than the project itself.

Hot Wallets And Vault Math: Triple-A And Summer.fi

Not every major loss this month came from oracles or bridges. Singapore-based payments firm Triple-A saw its treasury wallets drained across seven different blockchain networks, with losses climbing to $11.8 million over 31 hours as new deposits kept arriving at the compromised wallets and getting swept immediately, seemingly without the team even realizing deposits hadn’t been disabled. Triple-A maintained in its official statement that client funds, held separately under its custody model, were never at risk, and security researchers pinned the root cause on compromised hot wallet key management rather than any smart contract flaw, a distinction that matters for classification but not for the roughly $11.8 million that’s now gone.

Summer.fi’s Lazy Summer Protocol lost about $6 million in a single atomic transaction after an attacker exploited how the vault calculated its net asset value. Using a $65.4 million flash loan, the attacker deposited tokens from a Silo market vault that had been frozen since the November 2025 Stream Finance collapse, tokens whose on-chain valuation never corrected after that market halted, and whose reported value kept quietly accruing interest despite the underlying funds being stranded. By donating those stale, overvalued tokens into the vault’s accounting system, the attacker inflated the vault’s apparent assets and redeemed far more than they’d actually deposited. I think this is a genuinely instructive failure: a protocol trusting another, unrelated protocol’s frozen, stale pricing data as if it were still live and accurate. Summer.fi’s post-mortem walks through exactly how that gap opened up.

What The Industry Actually Needs To Fix

Looking at all ten incidents together, I don’t think July was an unlucky month. I think it was a predictable one, given how many of these failures trace back to the same handful of unresolved categories.

Oracle trust needs to stop being a single point of failure.

• AFX, Ostium, and Bonzo Lend collectively lost roughly $57 million because each protocol trusted a single signer or price feed without deviation checks, redundant sourcing, or delay mechanisms that could have caught an implausible price before it triggered a payout.
• What I find most damning about the Ostium case specifically is that the exact component that failed, its PriceUpKeep infrastructure, was explicitly excluded from the scope of its own bug bounty program, so the researchers most likely to have caught this were told not to look there.

Bridge message encoding needs standardized, audited formats rather than custom concatenation schemes.

• Wanchain’s entire $13 million loss traced back to missing delimiters between fields in a signed message, a defect that a basic fuzzing test should have caught before mainnet deployment.
• Verus getting hit twice with the identical bug class months apart shows that “we patched it” claims need independent verification, not just an internal team’s word that the issue is resolved. I think that repetition is the most damning detail in this entire bridge category.

Governance systems need real timelocks and meaningfully higher quorum thresholds.

• BonkDAO’s entire $21.2 million loss was legal under its own rules specifically because a 1% threshold with no delay period let a single well-capitalized actor bypass the spirit of decentralized voting entirely.
• Nothing about that incident involved broken code, which is exactly what makes it the one I find most conceptually unsettling.

Hot wallet monitoring needs automated circuit breakers.

• Triple-A’s losses kept compounding for 31 hours specifically because new deposits weren’t disabled even after the breach was detected, a gap that basic automated alerting should have closed within minutes, not over a day later.

Protocols integrating with other DeFi systems need to treat external pricing data as suspect the moment it stops updating normally.

• Summer.fi trusted the frozen Silo vault’s reported value long after the underlying market it represented had halted, rather than assuming stale pricing data was still trustworthy just because no one had updated it to say otherwise.
• I think this is a genuinely instructive failure precisely because nobody hacked anything.

None of these fixes are exotic. They’re the same lessons the industry has learned and re-learned after nearly every major incident going back years. I think July’s $210.3 million total isn’t evidence that attackers got smarter. It’s evidence that too many protocols are still shipping without the specific, well-documented protections that would have stopped nearly every hack on this list before it started.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. Follow us on X @nulltxnews