Immunefi: Crypto Lost $110 Million to Hacks in July

• Immunefi’s latest report puts July’s crypto hack and exploit losses at roughly $110 million.
• The firm said its audit competitions have been outperforming traditional tier-1 security audits at catching vulnerabilities.
• No single incident dominated the month, which is a shift from the outsized breaches that drove losses earlier this year.

Crypto lost roughly $110 million to hacks and exploits in July, according to a new report from web3 security firm Immunefi. Unlike prior months, the losses this time were spread across a cluster of mid-sized incidents and not concentrated in one catastrophic breach.

The largest single incident came from AFX Trade, which lost about $24.15 million. BonkDAO followed closely behind at nearly $20 million, in a case Immunefi’s data shows didn’t even require a traditional exploit: attackers spent roughly $4 million buying up BONK tokens to hit governance quorum and pass a proposal moving 4.43 trillion tokens out of the platform’s treasury. 

Wanchain lost $10 million to a signature reuse exploit between July 22 and 26, while Triple-A had its hot wallet drained of $9.7 million over July 24 and 25. Bonzo rounded out the month’s larger incidents with a $9 million loss tied to oracle manipulation on July 11.

Relevant:

• Hong Kong Raises Fun Coffee Scam Losses to HK$ 104 Million
• Violent Crypto Attacks Top $30M in 2026, France Leads

Bug Bounties Gain Ground on Traditional Audits 

Immunefi tied July’s comparatively contained losses to its bug bounty and audit competition model, arguing the format is now catching more vulnerabilities before launch than conventional tier-1 audits manage. 

The firm’s model pits multiple independent researchers against a codebase simultaneously over a fixed window, rather than relying on a single audit firm working alone. Immunefi has said this structure surfaces edge cases a single reviewer is more likely to miss, and the July data adds another data point to that case.

The figure fits into a broader downward trend Immunefi has tracked this year. The firm’s H1 2026 report found the industry lost about $972 million across a record 207 incidents in the first half of the year, even as DeFi-specific exploit losses fell 74% from their 2022 peak. 

Bridge exploits, once responsible for the majority of DeFi losses, have largely faded from the picture, while flash loan attacks now account for a fraction of a percent of total losses.

Attackers Shift Beyond Smart Contract Bugs 

The July numbers suggest attackers are increasingly turning toward governance manipulation, signature reuse, and oracle exploits and not the smart contract bugs that dominated earlier hacking cycles. 

That shift tracks with a pattern security researchers have flagged for much of 2026: as basic smart contract auditing has matured, the more sophisticated failure points now sit in governance design, cross-chain messaging, and privileged access controls.

Immunefi didn’t say whether it expects August losses to follow a similar pattern, though the firm’s researchers have paid out more than $140 million in lifetime bounties to date, a threshold it crossed back in June.

Sources:

Immunefi: Research and Reports

Yahoo Finance: Losses From Crypto Hacks Fell Below $1 Billion in Year’s First Half