Cryptocurrency thefts totaled $247.4 million in July, making it the second-worst month of 2026 after April, according to DefiLlama data. The monthly total was more than three times higher than June’s $75 million and well above May’s $60 million.

The sharp rise was driven mainly by the Coldcard exploit, the largest incident recorded in July. Reported losses from that attack alone exceeded $100 million, highlighting how a single breach can reshape the month’s overall loss figures.

July ranks just behind April

DefiLlama’s figures place July behind only April, when $644 million in cryptocurrency was stolen. With $247.4 million lost in July, the month stands out as one of the worst periods for crypto security incidents so far this year.

The comparison with recent months underscores the jump in activity. June losses came to $75 million, while May saw about $60 million stolen, making July a clear break from the lower totals seen earlier in the summer.

Coldcard was the largest incident

Galaxy Digital said the Coldcard exploit led to at least $100 million in Bitcoin being stolen from 7,300 wallets across three confirmed attack waves. The firm also identified a suspected fourth wave that could raise the overall damage to roughly $130 million.

DefiLlama’s hack tracker currently estimates losses linked to the Coldcard exploit at $115 million. The differing totals reflect the uncertainty that can remain in the aftermath of a large-scale incident as investigators assess wallet activity and attribute losses.

Other attacks added to the monthly total

Several other exploits contributed to July’s losses, though they were much smaller than the Coldcard incident. DefiLlama and the source report listed a $24 million theft from Arbitrum-based perpetual exchange AFX, a $9 million hack affecting decentralized finance protocol Bonzo Lend, and $7.5 million stolen through the Verus Ethereum Bridge.

A further $2.6 million was reported stolen from Cardano-based wallet SecondFi. Together, these incidents added to a month in which multiple parts of the crypto ecosystem, from bridges to trading platforms and wallets, were hit.

What the data suggests next

CryptoRank said in a Thursday post on X that July showed cold storage does not remove technological risk and can still put thousands of wallets at risk at once. That observation followed the scale of the Coldcard incident, which stood apart from the rest of the month’s exploits.

For now, the confirmed picture is that July closed with $247.4 million in reported crypto thefts, according to DefiLlama, and that the Coldcard case remains the main driver of that total. Whether the final losses from Coldcard move closer to Galaxy Digital’s higher estimate depends on whether the suspected fourth wave is confirmed.

Source: cointelegraph.com