Smart Contract Hacks Drive $247 Million July Losses And Expose Systemic Risks

• July 2026 recorded $247.4 million in cryptocurrency thefts, ranking as the second-worst month of the year.
• The Coldcard hardware wallet exploit compromised 7,300 wallets, causing systemic losses across cold storage.
• Malware campaigns are increasingly exploiting blockchain immutability to evade security takedowns and steal credentials.
• Unsafe smart contract approvals remain a persistent threat, having caused over $600 million in losses by Q1 2026.

July 2026 emerged as the second-worst month for cryptocurrency thefts in 2026, with hackers stealing $247.4 million. This figure surpasses June's $75 million and May's $60 million, trailing only April's $644 million. The primary driver was the Coldcard exploit, which compromised at least 7,300 wallets across three confirmed attack waves. Galaxy Digital estimates Bitcoin losses from this exploit at $100 million, with a suspected fourth wave potentially raising total losses to $130 million. DefiLlama’s hack tracker estimates Coldcard-related losses at $115 million.

Other notable exploits in July included a $9 million hack against Bonzo Lend, $2.6 million from SecondFi, $24 million from AFX, and $7.5 million from the Verus Ethereum Bridge. CryptoRank noted that the event demonstrated that even cold storage does not eliminate technological risks, potentially putting thousands of wallets at risk simultaneously. These losses highlight the fragility of security assumptions in both hardware and software ecosystems.

How Are Hackers Using Blockchain To Evade Detection?

Cybercriminals are exploiting the immutability of the BNB Smart Chain to distribute malware through a campaign identified by Microsoft Threat Intelligence as ClickFix or TerminalFix. The technique, called EtherHiding, involves embedding malicious commands and configuration data directly into smart contracts. When users visit compromised websites, typically hijacked WordPress sites, injected JavaScript calls the blockchain to retrieve Base64-encoded instructions. These instructions are decoded and executed by the browser, installing information-stealing malware such as Lumma Stealer.

Lumma Stealer harvests passwords, wallet credentials, and session cookies from targeted devices. Because the malicious payloads are stored on-chain, attackers can update them without modifying the compromised websites. Security teams cannot easily remove the contracts due to the network's censorship-resistant nature. The campaign targets both enterprise and consumer devices and is linked to the broader ClearFake initiative. Defensive measures include never executing commands from CAPTCHA prompts and keeping systems updated.

This method represents a significant shift in threat vectors, as it leverages the trust users place in blockchain data to bypass traditional endpoint security. The ability to dynamically update attack instructions without touching the hosting infrastructure makes containment exceptionally difficult for defenders.

Why Do Unsafe Token Approvals Remain A Major Threat?

Smart contract approvals create a significant security loophole in DeFi, as unlimited permissions remain active long after users stop interacting with a protocol. Attackers exploit these old approvals to drain assets without private key access, resulting in over $600 million in losses by the end of Q1 2026. To mitigate this, investors are turning to specialized tools for regular approval audits.

Revoke.cash is the industry standard for identifying unsafe token approvals across 100+ EVM chains. It displays all ERC-20, ERC-721, and ERC-1155 permissions, allowing users to revoke unlimited allowances with a single transaction. Etherscan’s Token Approval Checker offers a blockchain-native alternative, listing approved spenders and remaining allowances for direct revocation via wallet connection.

Wallet-integrated solutions like Rabby Wallet provide proactive protection by simulating transactions and flagging unlimited approvals or unverified contracts before signing. DeBank serves as a multi-chain portfolio tracker that doubles as an audit tool, using decoded transaction data to label suspicious activity and help users review inactive protocols. For phishing prevention, Wallet Guard and Scam Sniffer maintain databases of known scam contracts and simulate requests to alert users to dangerous approval patterns.

The persistence of these losses underscores the need for continuous user vigilance and automated tools to manage permissions. As DeFi ecosystems expand, the attack surface for approval-based exploits continues to grow, requiring users to adopt stricter security hygiene.