July 2026 Web3 Hack Recap: $200M Lost as Keys, Firmware, and Oracles Beat Code ## TL;DR July 2026 reversed May and June's calm hard. Total losses landed between roughly $199 million and $210 million across 30 to 35 incidents, a jump of 160 to 177 percent over June's roughly $76 million. There was a single dominant event: a firmware flaw in Coldcard hardware wallets that generated guessable recovery seeds, draining about $70 million in Bitcoin in a 41-minute window. Beneath it, the month's damage clustered around infrastructure rather than contract logic. Keys and credentials accounted for roughly 54 percent of dollars lost, DeFi protocol exploits about 25 percent, and bridges about 21 percent. The standout technical stories were an oracle-signer compromise at Ostium ($18M), a bought governance vote at BonkDAO ($20M), and a bridge signature replay at Wanchain caused by ambiguous message encoding (~$13M). Recoveries were thin: Bonzo Lend restored user positions with foundation backing, but most attackers kept the funds. The lesson of the month is blunt. The most expensive failures in July never touched a `require` statement; they lived in seed generation, signing keys, oracle signatures, and quorum thresholds. [Get your protocol audited before you become next month's headline →](https://app.cecuro.ai/auth?mode=signup) --- ## The Numbers That Define July 2026 After three straight months under or near $100 million, July snapped back to a nine-figure total. Trackers disagree on the exact figure, as they always do, because they draw the line for "counted incident" in different places. One widely cited tally puts July at about $210.3 million across 30 incidents, a 177 percent increase over June's $75.9 million. Another counts roughly $198.8 million across 34 to 35 incidents, up about 160 percent over June. Either way, the direction is the same: July was two to three times worse than the month before it. The more useful number is the composition. By dollars lost, this was a month of key and credential compromise, which accounted for roughly $107 million, about 54 percent of the total. DeFi protocol exploits, the classic smart contract bug category, made up around $50 million, or 25 percent. Bridges accounted for about $42 million, or 21 percent. By incident count the picture inverts: the large majority of individual incidents were DeFi protocol exploits, heavily weighted toward oracle and price-feed manipulation, but each one was small. The big dollars came from a handful of infrastructure failures. One caveat worth stating up front. These totals were assembled before the Coldcard incident's full scope was clear. The initial count was about $70 million; later analysis identified additional draining waves that may push the observed Bitcoin loss closer to $88 million, though attribution of the later waves is uncertain. If those are counted as July losses, the month's top-line total rises accordingly. The pattern that connects the month is one we have flagged all year and it only sharpened in July: the code is increasingly not the weakest link. Seed randomness, signing keys, oracle signatures, and governance quorums are where the money actually left. --- ## The Big Story: Coldcard Firmware and the Price of Weak Randomness **Loss:** ~$70.2 million (1,082 BTC), with later waves possibly raising the total toward $88 million **Date:** July 30, 2026 (first wave drained in 41 minutes) **Attack type:** Weak entropy in hardware-wallet seed generation The single largest loss of the month did not involve a smart contract at all. It involved the device millions of people trust specifically to keep smart contracts from touching their coins. A defect in older Coldcard hardware-wallet firmware produced recovery seeds with far less randomness than intended. According to post-incident analysis, affected firmware routed seed generation through a deterministic software pseudo-random number generator instead of the device's dedicated hardware RNG. That cut the effective entropy of the recovery phrase from the intended 128 bits down to roughly 40 bits, low enough that an attacker who understood the flaw could brute-force the seed space. The result was a coordinated sweep. Roughly 1,082 BTC, about $70.2 million, was drained from 1,196 separate Bitcoin addresses in a 41-minute window. There was no phishing, no malicious approval, no contract interaction to detect or reverse. The private keys were simply guessable, so the attacker computed them and moved the coins. Coinkite, Coldcard's maker, shipped patched firmware and urged affected users to migrate to freshly generated seeds, while acknowledging it could not reliably identify every exposed wallet without direct testing. Notably, the company suspected the attacker used AI to help discover the flaw. **Why it matters for smart contract teams:** Randomness is a security primitive, not an implementation detail. The exact same failure class shows up on-chain constantly, weak or predictable randomness in NFT mints, games, lotteries, and any contract that derives a "secret" from a low-entropy or attacker-observable source. A weak RNG turns "computationally impossible to guess" into "guessable" without any exotic exploit. Whether the code runs on an STM32 in a hardware wallet or in the EVM, the principle holds: if an attacker can narrow your keyspace, the strength of everything built on top of it collapses. ```solidity // VULNERABLE: on-chain "randomness" an attacker can predict or influence. // block.prevrandao, timestamp, and sender are all known or grindable. function drawWinner() external returns (uint256) { return uint256( keccak256(abi.encodePacked(block.prevrandao, block.timestamp, msg.sender)) ) % participants.length; } ``` ```solidity // HARDENED: source randomness from a verifiable, external beacon (e.g. a VRF) // and commit to it before it can be known. function requestWinner() external { require(!drawPending, "Draw in progress"); drawPending = true; vrfRequestId = vrfCoordinator.requestRandomWords(keyHash, subId, 3, gasLimit, 1); } function fulfillRandomWords(uint256 requestId, uint256[] memory words) internal override { require(requestId == vrfRequestId, "Bad request"); winner = participants[words[0] % participants.length]; drawPending = false; } ``` **Key lesson:** Never derive anything that must be unguessable from a source an attacker can observe, grind, or reconstruct. Use a verifiable randomness beacon on-chain, and audited hardware entropy off-chain. Entropy is the foundation; if it is weak, nothing above it is safe. --- ## Oracles: The Signature That Signs a Lie Two of July's most instructive exploits shared a root cause: an oracle that trusted a signature without questioning the values it carried. ### Ostium: $18 Million (July 15) **Attack type:** Compromised oracle signer key Ostium, a perpetuals protocol on Arbitrum, lost about $18 million (roughly a third of its $63 million in total value locked) after an attacker obtained the private key behind its price oracle. With that key, the attacker signed fabricated, future-dated price reports, at one point reporting Bitcoin at around $5,000 against a real price near $60,000, and pushed them through the protocol's price-update forwarders. The fake prices triggered payouts on fabricated profitable trades, draining USDC from the vault. Stolen funds were converted to ETH, dispersed, and a substantial portion routed through a mixer. No compensation plan had been announced as of early August. The failure is not that a key was stolen; keys get stolen. The failure is that the protocol had no independent check on what the signed price could plausibly be. A signature proved the message came from the expected signer. Nothing proved the price was real. ### Bonzo Lend: $9.05 Million (July 11) **Attack type:** Oracle verifier accepted a manipulated price update Bonzo Lend, a lending protocol on Hedera, was drained for about $9.05 million through a verification flaw in a third-party oracle contract it relied on. The oracle's verifier accepted an improperly signed (effectively zeroed-signature) price update, letting the attacker push a manipulated price for the SAUCE token and over-borrow against it. This is the same structural weakness as Ostium, expressed one layer down: instead of stealing the signer's key, the attacker exploited a verifier that did not properly enforce that the signature was valid. In a better outcome than most of the month, Bonzo announced it would restore pre-exploit user positions with backing from the Hedera Foundation. **The pattern both share:** ```solidity // VULNERABLE: trust the signer, never sanity-check the value. function updatePrice(int256 price, uint256 timestamp, bytes calldata sig) external { require(recover(price, timestamp, sig) == oracleSigner, "Bad signer"); // A stolen key or a broken verifier makes `price` fully attacker-controlled. prices[asset] = price; lastUpdate = timestamp; } ``` ```solidity // HARDENED: bound the value, reject stale or future timestamps, // and cross-check against a second independent source. function updatePrice(int256 price, uint256 timestamp, bytes calldata sig) external { require(recover(price, timestamp, sig) == oracleSigner, "Bad signer"); require(timestamp <= block.timestamp, "Future-dated"); require(block.timestamp - timestamp <= MAX_STALENESS, "Stale"); int256 ref = fallbackOracle.latestAnswer(); // Reject any update that deviates too far from an independent feed. require(_withinDeviation(price, ref, MAX_DEVIATION_BPS), "Deviation too large"); prices[asset] = price; lastUpdate = timestamp; } ``` **Key lesson:** An oracle is only as trustworthy as the key that signs it and the verifier that checks it, and neither should be a single point of failure. Price feeds need sanity bounds, staleness and future-timestamp rejection, and multi-source cross-checks so that one compromised signer or one broken verifier cannot dictate reality to your protocol. --- ## Governance: BonkDAO and a $20M Treasury Reachable by One Vote **Loss:** ~$20 million **Date:** Proposal submitted June 30, executed July 6 **Attack type:** Governance takeover via acquired voting power The BonkDAO drain is the cleanest example of the year of an attack in which no code failed at all. The system worked exactly as designed. That was the problem. Over several days, an attacker spent roughly $4.4 million acquiring just over one percent of the BONK supply through exchange wallets. That was enough voting power to push Bonk Improvement Proposal #76 through the DAO's governance, which runs on Solana Realms. Turnout was about 2.9 percent. Seven wallets voted. The proposal cleared quorum by a razor-thin margin (roughly 882 billion votes against an 880 billion threshold) and passed. Execution moved approximately 4.4 trillion BONK, worth around $20 million, to a wallet linked to an exchange account. There was no timelock and no multisig standing between the passing vote and the treasury. **Key lesson:** Governance is attack surface. Quorum thresholds, timelocks, and proposal-execution delays are security controls, and they have to be sized against the value they protect. A treasury reachable by a single passing vote, with low turnout and no execution delay, is a treasury with a purchase price. The defense is layered: meaningful quorum requirements, a timelock between approval and execution long enough for the community to respond, and a multisig or guardian able to veto an obviously malicious proposal before it settles. --- ## Bridges: Two Ways to Forge a Withdrawal Bridges again produced some of the month's largest clean thefts, and July offered two textbook failure modes. ### AFX Trade: $24.15 Million (July 22) **Attack type:** Compromised bridge validator signing keys AFX Trade lost 24.15 million USDC from its self-operated Arbitrum bridge after an attacker compromised five of the bridge's seven validator signing keys, enough to clear the approval threshold and authorize a withdrawal. Initial access reportedly came through social engineering: a fake recruiter delivered a malicious Git repository to a developer's machine. The stolen USDC was bridged to Ethereum and swapped into roughly 12,467 ETH. A 30 percent bounty offer went unanswered; instead the attacker began laundering funds through a cross-chain swap service. Critically, Arbitrum's native bridge was never involved. This was a failure of AFX's own multi-validator setup. The lesson is one May's Gravity Bridge incident made and July repeated: a signing threshold is only as strong as the independence of its keys. Five of seven keys reachable from one compromised operational environment is not a five-of-seven multisig; it is a single point of failure wearing a multisig costume. ### Wanchain Cardano Bridge: ~$13 Million (July 20) **Attack type:** Signature replay via non-injective message encoding The Wanchain exploit is the one every developer should study, because the bug is entirely preventable and the mechanism is subtle. The bridge built the message it signed by concatenating fourteen variable-length fields together with no separators or length prefixes between them. That makes the encoding non-injective: two different sets of field values can serialize to the same byte string. A legitimate signature authorizing roughly 3,110 NIGHT on BNB Chain could therefore be reinterpreted and replayed to authorize a Cardano withdrawal of 203,001,692 NIGHT, more than 65,000 times the intended amount. Four transactions over eight minutes drained 515.2 million NIGHT from the bridge treasury, worth around $13 million, and roughly 90 percent was liquidated through DEX swaps. Wanchain offered a 10 percent white-hat bounty with an August 6 deadline; as of this writing no funds had been returned. ```solidity // VULNERABLE: abi.encodePacked concatenates variable-length fields with no // delimiters. Different inputs can produce identical bytes, so one valid // signature can be replayed to authorize a completely different transfer. bytes32 digest = keccak256(abi.encodePacked( chainId, recipient, tokenId, amount, nonce, /* ...9 more fields... */ )); ``` ```solidity // HARDENED: abi.encode pads every field to a fixed 32-byte slot, so the // encoding is injective. Distinct inputs always produce distinct digests. bytes32 digest = keccak256(abi.encode( chainId, recipient, tokenId, amount, nonce, /* ...9 more fields... */ )); ``` **Key lesson:** Ambiguous message encoding is a classic, well-documented bug class, and it is trivially avoidable. Use `abi.encode` rather than `abi.encodePacked` whenever you hash more than one variable-length field, and fuzz the signed payload to prove that no two distinct transfers can ever collide to the same digest. Basic differential fuzzing of the encoder would have surfaced this before mainnet. --- ## The Middle Tier: Repeat Attacks and Realized-vs-Minted Gaps Below the top incidents, July produced a dense band of losses in the low-to-mid millions, several of which carry lessons out of proportion to their size. **Triple-A ($11.8M):** A Singapore stablecoin payments firm lost funds from hot-wallet infrastructure across Ethereum, Tron, and Arbitrum, with balances consolidated into a single Ethereum address by the attacker. The failure point was credentials, not contract logic. Multi-chain operations multiply the key-management surface, and hot-wallet balances should be capped at operational float with the remainder behind hardware-backed multisig. **Verus Ethereum Bridge ($7.54M, July 23):** The most avoidable loss of the month, because it was the second time. The same import-path vulnerability class exploited in May was hit again, by a different attacker, using a 0.01 VRSC transaction to trigger unbacked payouts of 1,137 ETH, 71.5 tBTC, and more. The detail that stings: funds recovered from the May incident had been redeposited into the bridge on July 8 and were drained again fifteen days later. The most expensive vulnerability is the one you patched incompletely. Every fix needs an independent review and a regression test proving the whole bug class is closed, not just the one path that was exploited. **WEMIX ($6.25M minted, ~$724K realized):** A compromised contract-owner key on WEMIX3.0 was used to mint 5.23 million unauthorized WEMIX$ stablecoin tokens on July 26. Only about $724,000 was actually converted and bridged out before the team froze bridges, a reminder that headline "minted" figures and realized losses can diverge by an order of magnitude. Owner and admin keys are the highest-value target in any deployment and belong behind multisig and timelocks. **Summer.fi ($6M, July 6):** An attacker used a $65.4 million flash loan to temporarily inflate the protocol's reported assets, then initiated a withdrawal of roughly $70.9 million against that inflated accounting, netting about $6 million in DAI. Share price and vault accounting must be immune to single-block balance swings; if a flash loan can change what your vault believes it holds, the accounting is the vulnerability. **Across Protocol (<$4M net, July 17):** An off-chain Solana relayer failed to verify the 8-byte Anchor event discriminator, letting the attacker spoof deposit events and submit 1,627 forged deposits with about $41.7 million in face value, of which 581 were filled before detection. No user funds were lost; relayers absorbed the loss and genuine transfers were refunded the same day. The lesson is that off-chain infrastructure needs the same input-validation rigor as on-chain code; an unverified event discriminator is the off-chain equivalent of an unchecked function selector. --- ## The Long Tail July's smaller incidents reinforce the month's central themes: oracle and price-feed manipulation dominated by count, and off-chain compromise kept surfacing. | Protocol | Date | Loss | Exploit Type | Chain(s) | | --- | --- | --- | --- | --- | | SecondFi | Jul 22 | $2.4M | Private key derivable from signing-software flaw | Cardano | | Allbridge Core | Jul 20 | $1.65M | Flash-loan pool-ratio manipulation (second time) | Solana | | Cascade | Jul | $1.34M | Price-feed manipulation | — | | 42DAO | Jul | ~$912K | Median oracle BTCB manipulation, token fell 99% | BNB Chain | | BarnBridge | Jul 15 | $776K | Malicious contract swap drained existing approvals | Ethereum | | TeleSwap | Jul 15 | $735K | Bridge exploit | — | | Bankrbot | Jul | $480K | Compromised account | Ethereum | | Edel Finance | Jul | $403K | Price-feed manipulation | — | | Garden Finance | Jul 26 | $450K | Compromised solver database, forged HTLC data | Multi-chain | | Zilliqa | Jul 20 | Undisclosed | Exchange partner cold-wallet compromise | Zilliqa | Two of these echo earlier incidents directly. Allbridge Core's flash-loan manipulation was the second time the protocol was hit the same way, and Garden Finance's solver-database compromise was its second solver breach after a much larger one in October 2025. BarnBridge's exploit is a governance-adjacent classic: the attacker swapped a yield contract for a malicious version and drained funds through approvals users had already granted. --- ## Attack Pattern Analysis: What July 2026 Tells Us Across the month, four patterns account for nearly all of the damage. | Attack Pattern | Notable Incidents | Approx. Losses | Share of Total | | --- | --- | --- | --- | | Key / credential compromise | Coldcard, AFX Trade, Triple-A, WEMIX | ~$107M | ~54% | | Oracle / price-feed manipulation | Ostium, Bonzo, Cascade, 42DAO, Edel | ~$30M+ | large by count | | Bridge verification / replay | AFX, Wanchain, Verus, TeleSwap | ~$42M | ~21% | | Governance takeover | BonkDAO, BarnBridge | ~$21M | ~10% | ### Pattern 1: Keys and Credentials Did the Most Damage More than half of July's losses traced to a compromised key or credential rather than a code bug: Coldcard's guessable seeds, AFX's validator keys, Triple-A's hot wallets, WEMIX's owner key, Ostium's oracle signer. None of these were exotic zero-days in Solidity. They were the slow accumulation of over-privileged keys, weak entropy, and credentials reachable through social engineering. This is the category audits alone cannot fully close, which is exactly why key management, rotation, and hardware-backed signing have to be treated as first-class security work. ### Pattern 2: Oracles Are the Most Common Single Point of Failure By incident count, oracle and price-feed manipulation dominated July. Ostium and Bonzo lost the most, but Cascade, 42DAO, and Edel Finance all fell to variations of the same theme: a protocol that trusted a price it should have questioned. Any system that makes financial decisions off a price feed needs sanity bounds, staleness checks, and an independent second source. A single feed with no cross-check is a lever an attacker will eventually pull. ### Pattern 3: Bridges Keep Failing at Verification AFX, Wanchain, and Verus all failed at the moment of verifying a cross-chain authorization, through stolen keys, replayable encoding, and an incompletely patched flaw respectively. Bridges validate that a withdrawal is authorized; they too rarely validate that the authorization is unique, that the value is conserved, and that the whole bug class from the last incident is actually closed. ### Pattern 4: Repeat Attacks Are Preventable and Keep Happening Verus was drained through the same class of flaw twice in three months. Allbridge Core and Garden Finance were each hit a second time. When a protocol is exploited, the fix has to close the vulnerability class, not just the exploited path, and it has to be verified by an independent review before funds go back in. Redepositing recovered funds into an unproven bridge, as happened with Verus, is how a patched incident becomes a repeat headline. --- ## What Would Have Prevented These Attacks Every major July exploit maps to a known, preventable vulnerability class. **For key and entropy failures (Coldcard, AFX, Triple-A, WEMIX):** Strong, verifiable randomness for anything that must be unguessable, hardware entropy off-chain and a VRF on-chain. Signing keys distributed across genuinely independent environments so a single compromise cannot clear a threshold. Hot-wallet balances capped at operational float, with the rest behind hardware-backed multisig. Owner and admin keys behind timelocks so a stolen key buys time pressure, not instant settlement. [Audit your smart contracts with Cecuro →](https://app.cecuro.ai/auth?mode=signup) **For oracle manipulation (Ostium, Bonzo, Cascade, 42DAO, Edel):** Sanity bounds on every price update, rejection of stale and future-dated timestamps, and cross-checks against at least one independent feed. Verifier logic that strictly enforces signature validity, with no path that accepts a zeroed or malformed signature. **For bridge exploits (AFX, Wanchain, Verus, TeleSwap):** Injective message encoding (`abi.encode`, not `abi.encodePacked`, for multi-field hashing), with differential fuzzing to prove no two transfers collide. Conservation-of-value checks and daily volume caps. Independent verification of every fix after an incident, and a regression test that proves the bug class is closed before any funds are redeposited. **For governance takeovers (BonkDAO, BarnBridge):** Quorum thresholds and timelocks sized against the value in the treasury, an execution delay long enough for the community to respond to a malicious proposal, and a guardian able to veto before settlement. --- ## What This Means for Protocol Builders July 2026 makes a point the whole year has been building toward: the attack surface has moved outward from the contract. The largest losses came from a hardware wallet's entropy, a set of validator keys, an oracle signer, and a governance quorum, none of which a Solidity-only audit would fully cover on its own. The takeaway is not that smart contract audits matter less. Ostium's missing price bounds, Wanchain's ambiguous encoding, Summer.fi's flash-loan-manipulable accounting, and BarnBridge's approval drain are exactly the kind of flaws a thorough review catches before deployment. The takeaway is that security has to cover the full lifecycle, from a single function's access modifier to the keys that govern it to the oracles it trusts to the governance that controls it. Modern protocol security works in three layers. **Layer 1: Pre-deployment auditing.** Comprehensive review covering code correctness, oracle sanity checks, bridge encoding and value conservation, access control on every state-changing function, and governance execution safety. This is where Ostium's unbounded prices, Wanchain's non-injective encoding, and Summer.fi's flash-loan exposure should be caught before they ship. **Layer 2: Continuous monitoring.** Real-time detection of anomalous activity: oracle prices that deviate from independent feeds, bridge withdrawals that exceed locked value, mints with no backing, and governance proposals that move treasury funds. July's attackers moved in minutes, so monitoring has to trigger automated responses, not just alerts. **Layer 3: Operational security.** Key rotation, hardware-backed signing, independent signing environments, timelocked governance, and verified fixes after any incident. This is the layer that produced most of July's losses, and it is the one teams neglect most. Here is how Cecuro fits against the traditional model. | Dimension | Traditional Audit | Cecuro | | --- | --- | --- | | Turnaround | 2 to 6 weeks | Hours, typical | | Cost | $20K to $100K+ | Free trial, pricing starts at $799, about 90% less | | Coverage | Often single-chain focus | All chains and smart contract languages | | Technology | Manual, schedule-limited | AI-powered, multi-agent analysis | | Detection | Varies by reviewer | #1 on EVMBench | Cecuro's AI-powered platform analyzes smart contracts across all chains and languages in hours, not weeks. It offers a free trial, and pricing starts at $799, roughly 90 percent lower cost than traditional approaches, without trading away depth. Cecuro ranks first on EVMBench, the independent smart contract exploit benchmark. Our analysis threat-models the exact patterns that defined July 2026: oracle sanity bounds, bridge encoding and value conservation, governance execution safety, and access control on privileged functions. [Start your free audit today →](https://app.cecuro.ai/auth?mode=signup) --- ## Looking Ahead: August 2026 July's snap back to a nine-figure total is a reminder that a single quiet month means nothing about the next one. The underlying attack surface did not shrink in June and July; it kept widening. Three signals point to where August and beyond are heading. Key and credential compromise is now the dominant loss category, and it is the hardest to fix with code alone. Expect more Coldcard-style entropy and firmware stories, more social-engineering paths to signing keys, and more losses that never touch a contract. Oracle manipulation remains the most common single failure mode by count, which means every protocol pricing off a single feed is carrying risk it may not have quantified. And repeat attacks keep proving that incomplete fixes are their own vulnerability class. The protocols that stay out of next month's recap will be the ones that treat security as continuous and complete: code, keys, oracles, bridges, and governance, reviewed and monitored as an ongoing cycle rather than a one-time checkbox. July 2026 cost the industry around $200 million. The lessons were cheaper to learn than to ignore. --- The Cecuro Security Team publishes monthly hack recaps to keep the community informed about emerging threats and prevention strategies. For real-time smart contract auditing and continuous protocol monitoring, visit [app.cecuro.ai](https://app.cecuro.ai).