Major Crypto Attack Steals $25.6 Million; July Losses Mount to $242 Million
A significant cryptocurrency theft targeting unknown holders resulted in $25.6 million in losses, while monthly security data reveals mounting vulnerabilities across the digital asset ecosystem.
Recent Attack Targets Multiple Crypto Assets
Blockchain security researchers identified a significant cryptocurrency theft compromising multiple digital asset holders. According to PeckShield, the attack resulted in approximately $25.6 million in cryptocurrency losses. The compromised holdings encompassed roughly $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC, and $2.6 million in Ethereum tokens. In response to the breach, the perpetrator executed trades converting the stolen assets into approximately 20 million DAI and 3,000 ETH, with a reported value of approximately $5.64 million at the time of PeckShield’s report. The transferred funds now reside across four separate wallet addresses. The victims themselves remain unidentified.
July Emerges as Second-Heaviest Loss Month in 2026
This incident forms part of a broader security crisis affecting the cryptocurrency sector in July 2026. According to Nominis, a cryptocurrency analytics firm, major security incidents during the month generated approximately $242 million in aggregate losses spanning 28 distinct breaches, positioning July as the second-worst month for cryptocurrency losses this year. A significant contributor to these totals was a long-standing firmware vulnerability in Coinkite’s Coldcard hardware wallets. The previously unpatched security flaw, dormant for five years, accounted for roughly $116 million of the monthly losses—representing nearly one-half of the total. The remaining 27 security incidents collectively resulted in approximately $126 million in additional losses.
Examining 2026 year-to-date figures reveals alarming trends. Through July, major cryptocurrency security breaches have accumulated approximately $1.65 billion in total losses. The monthly progression shows: January at $385 million, February at $49.3 million, March at $178.1 million, April at $606.7 million, May at $124.9 million, and June at $62.2 million. April experienced the worst conditions, dominated by the Kelp DAO attack generating approximately $293 million in losses and the Drift Protocol attack resulting in approximately $285 million in losses. Combined, these two incidents accounted for roughly $578 million—approximately 95 percent of April’s total documented losses.
Infrastructure Vulnerabilities Demand Urgent Attention
The scale and frequency of major breaches throughout 2026 underscore persistent challenges in cryptocurrency security infrastructure. The five-year dormancy of the Coldcard firmware vulnerability exemplifies how legacy code paths escape detection for prolonged periods. As cryptocurrency adoption accelerates, the expanding attack surface—spanning protocol exploits, hardware vulnerabilities, and custody failures—demands comprehensive security measures and proactive vulnerability disclosure across all ecosystem participants. The diversity of attack methodologies indicates that security resilience requires layered defenses rather than single-point solutions.
With $1.65 billion in losses through July 2026 and vulnerabilities spanning storage and protocol layers, security remains a critical impediment to mainstream adoption and institutional participation in cryptocurrency markets.
Source: PeckShield, via U.Today. Not financial advice.