July 2026 delivered one of the more unusual months in recent crypto security history.
While 24 DeFi protocols lost a combined $132.2 million, a figure broadly in line with recent monthly averages, a single hardware wallet vulnerability overshadowed all of them. A flaw in Coldcard’s random number generation, originating from a 2021 firmware change, has so far resulted in approximately $110 million in losses. The total is still climbing.
This was not a smart contract exploit. It was not a bridge failure. It was not a compromised private key in the conventional sense. It was a failure in entropy.
The Coldcard Incident
In March 2021, a firmware migration on Coldcard devices unintentionally routed wallet seed generation through MicroPython’s software-based pseudorandom number generator instead of the device’s hardware true random number generator.
The result was a significant reduction in entropy:
Approximately 40 bits on Mk2 and Mk3 devicesApproximately 72 bits on Mk4, Q, and Mk5 models (even with secure element mixing)
Both figures fall well short of the 128-bit target expected for secure seed generation.
Coinkite disclosed the issue and released patched firmware on July 30, 2026. However, the update only protects newly generated seeds. Any wallet created on the affected firmware remains exposed.
Attackers began exploiting the weakness before the public disclosure. On July 30, roughly $70 million was drained in a 41-minute window, hours before the official advisory. Additional waves followed over the next several days. As of early August, the running total stood at approximately $110 million across thousands of wallets.
The stolen funds have so far remained unmoved. Thousands of additional wallets generated during the vulnerable period may still be at risk.
This incident highlights a critical and often under-discussed risk: the security of the seed generation process itself. Updating firmware does not remediate seeds that were already created with insufficient randomness. Affected users must generate new seeds and migrate funds.
The Broader Picture in July
Even excluding the Coldcard losses, July was a costly month for DeFi.
The largest protocol-related incidents included:
AFX Bridge ($24.15M) — An attacker controlled five of seven bridge validators on Arbitrum. After the challenge window expired without a dispute, 24.15 million USDC was released.Ostium ($23.75M) — A compromised off-chain price signing system allowed forged but validly signed price reports. The attacker used these to drain the OLP vault through leveraged positions.BonkDAO ($21.2M) — An attacker accumulated enough voting power to pass a malicious governance proposal. The proposal included a hidden treasury transfer that executed immediately, enabled by a zero-second timelock.Wanchain Cardano–BNB Bridge ($13.0M) — A signature encoding flaw allowed a legitimate signature to be reused for a significantly larger withdrawal.
These four incidents, combined with Coldcard, accounted for roughly 80% of July’s total losses.
Key Patterns
Several trends stood out in July:
Attack Vectors
Weak entropy / key generation failure: 45% of losses (driven almost entirely by Coldcard)Private key and credential compromise: 16%Oracle and price verification failures: 14%Protocol logic bugs: most common by frequency, but only 14% of dollar lossesCross-chain and signature reuse issues: 11%
Sectors
Hardware wallet / Bitcoin custody: $110M (45%)Bridges: $51M, remaining the most expensive DeFi category for the third consecutive monthPerpetuals and derivatives: $25.1MGovernance and DAO treasuries: $22MRemaining categories: approximately $34M
Bridges continue to represent a persistent and expensive attack surface. Governance designs where the cost of acquiring quorum is significantly lower than the value of the treasury they protect also remain a recurring weakness.
What This Month Actually Tells Us
The most important takeaway from July is not another list of DeFi exploits. It is the Coldcard incident.
Most security discussions in crypto focus on smart contract risk, bridge design, and access control. Coldcard demonstrates that foundational assumptions, in this case the quality of randomness used to generate wallet seeds, can fail quietly and remain undetected for years.
The vulnerability was introduced in 2021. It survived multiple reviews. It was only actively exploited at scale in mid-2026. By the time it was publicly disclosed, substantial losses had already occurred.
This is a different category of risk from the typical protocol exploit. It sits closer to supply-chain and implementation-level failures than to application-layer bugs.
For users, the practical implication is straightforward: any Coldcard seed generated between the 2021 firmware change and the July 30, 2026 patch should be treated as potentially compromised. New seeds should be generated, and funds should be migrated.
For the broader industry, July reinforces a familiar but still under-appreciated point. The most damaging failures are not always the most sophisticated ones. Sometimes they are the quiet assumptions that go unexamined for years.
Live tracking of all incidents is available on QuillMonitor.
A shorter version of this analysis was also published on X.
July 2026 Crypto Hacks: $242M+ Lost as a Hardware Wallet Bug Outweighed Every DeFi Exploit was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.