Coldcard Exploit Drives July Crypto Losses to $247M, Marking 2026's Second-Worst Month for Theft

Woofun AI reports that the Coldcard exploit served as the primary catalyst for July 2026 emerging as the second-worst month for cryptocurrency thefts to date.

The financial toll of $247.4 million in stolen assets represents a significant escalation from recent months, exceeding the $75 million lost in June and the $60 million lost in May by more than triple.

However, this figure remains substantially below the record $644 million stolen in April, which stands as the year's peak loss event.

Structurally, the disparity between July and the preceding months underscores a volatile trajectory in theft volumes throughout the first half of the year.

Woofun AI data shows that Galaxy Digital identified at least $100 million in Bitcoin (BTC) drained from 7,300 wallets across three confirmed attack waves. The firm also flagged a suspected fourth wave, potentially raising total Coldcard-related losses to approximately $130 million, while DefiLlama's tracker estimated the impact at $115 million. On Thursday, research platform CryptoRank noted on X that "July showed that even cold storage does not eliminate technological risks, which can put thousands of wallets at risk simultaneously."

Beyond the Coldcard incident, other significant exploits included a $24 million breach of Arbitrum-based perpetual exchange AFX and a $9 million hack of decentralized finance protocol Bonzo Lend. Additional losses comprised $7.5 million stolen through the Verus Ethereum Bridge and $2.6 million taken from Cardano-based wallet SecondFi. This concentration of high-value incidents highlights enduring vulnerabilities across both cold storage and decentralized infrastructure.