Coldcard exploit pushes July losses to $247M as second-worst month of 2026
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
In July 2026, cryptocurrency thefts totaled $247.4 million, marking the second-worst month of the year. The largest contributor was the Coldcard exploit, which resulted in at least $100 million in Bitcoin stolen from about 7,300 wallets across multiple attack waves. Additional exploits in July included hacks of Bonzo Lend, SecondFi, AFX, and the Verus Ethereum Bridge.
Why it matters
The Coldcard exploit demonstrates that even cold storage solutions, traditionally seen as highly secure, carry technological risks that can affect thousands of wallets simultaneously. This highlights vulnerabilities in crypto security practices and signals ongoing risks for crypto users and the industry.
Key context
Before July, April 2026 was the worst month with $644 million stolen. Theft amounts in May and June were significantly lower at $60 million and $75 million respectively. The Coldcard exploit involved multiple attack waves, with Galaxy Digital identifying a potential fourth wave possibly raising losses to $130 million. DefiLlama and CryptoRank have been tracking and quantifying these thefts.
Key numbers and entities
July crypto thefts: $247.4 million; Coldcard losses: at least $100 million (up to $130 million suspected); wallets affected: 7,300; April 2026 thefts: $644 million; June 2026 thefts: $75 million; May 2026 thefts: $60 million. Other hacks: Bonzo Lend ($9 million), SecondFi ($2.6 million), AFX ($24 million), Verus Ethereum Bridge ($7.5 million). Notable organizations: Galaxy Digital, DefiLlama, CryptoRank.
What remains unclear
The exact details of the initial vulnerability exploited in the Coldcard attack are not provided. The suspected fourth wave of attacks has not been fully confirmed, leaving room for uncertainty in the total loss estimation. The source does not elaborate on the specific security failures or response measures taken.