Ethereum and the broader crypto ecosystem faced a brutal July, with attackers stealing $97 million across 14 major security incidents. The troubling shift: hackers are no longer exploiting smart contract code flaws. Instead, they're targeting the invisible infrastructure that sits outside the blockchain itself, from price-feed systems to governance mechanisms to bridge verification keys.

What Changed in Crypto Security Attacks?

For years, the crypto industry focused on hardening smart contract code. Developers audited, tested, and patched vulnerabilities in the on-chain logic that powers decentralized finance (DeFi) protocols. But July's incidents reveal a fundamental shift in how attackers operate. According to blockchain security monitoring platforms, "attack vectors are rapidly shifting away from smart contract code vulnerabilities toward non-code-based methods such as off-chain infrastructure compromise, signature key exposure, and governance vote manipulation".

This matters because Ethereum and other networks have become increasingly dependent on systems that live outside the blockchain. Price oracles feed real-world data into smart contracts. Cross-chain bridges move assets between different blockchains. Governance systems allow token holders to vote on protocol changes. Each of these layers introduces new attack surfaces that traditional code audits don't catch.

How Did Attackers Target Ethereum and Cross-Chain Infrastructure?

The most striking pattern in July's attacks involved cross-chain bridges, which are systems that allow users to move cryptocurrency from one blockchain to another. These bridges became the primary target, with multiple attacks occurring in rapid succession within hours, resulting in combined losses exceeding $35 million.

One of the largest incidents involved AFX Trade, a decentralized perpetual futures exchange on the Arbitrum ecosystem (a layer 2 scaling solution built on Ethereum). On July 22, an attacker gained access to the private signing key of the bridge's validator nodes. This key is supposed to be kept secret; it's what proves that a withdrawal request is legitimate. The attacker used it to authorize fake withdrawals, moving approximately 24.15 million USDC from Arbitrum to Ethereum and converting it to 12,467.5 ETH at an average price of $1,937. The smart contract itself worked perfectly; it validated the signatures and released the funds as designed. The problem wasn't the code. It was that the key protecting the system had been compromised.

Similarly, Verus suffered a second attack on its Ethereum cross-chain bridge on July 23, losing approximately $7.55 million. This attack exploited the same contract pathway and vulnerability category as a previous May attack, highlighting how unpatched flaws and redeposited funds leave systems vulnerable to repeated exploitation.

Off-chain infrastructure failures extended beyond bridges. Ostium, an RWA (real-world asset) perpetual trading protocol on Arbitrum, lost approximately $23.75 million when an attacker gained access to its off-chain price signing system. The attacker fabricated Bitcoin price data, manipulating the BTC price to approximately $5,000, and used this false data to steal funds from the liquidity pool. Again, no smart contract vulnerability existed. The flaw was in the infrastructure that feeds prices into the contract.

Steps to Understand the New Security Landscape

• Off-Chain Infrastructure Risks: Systems that live outside the blockchain, such as price oracles, bridge validators, and governance platforms, are now primary attack targets. These systems often lack the same level of scrutiny and redundancy as on-chain smart contracts.
• Governance Vulnerabilities: BonkDAO lost approximately $20 million when an attacker exploited a governance rule flaw, not a code bug. The attacker spent $4 million to acquire enough BONK tokens to pass a malicious proposal with only a 1% voting threshold, then transferred 44.26 billion BONK tokens from the treasury.
• Key Management Failures: Multiple incidents, including the B² Network staking contract attack that cost $3.86 million, stemmed from compromised private keys and permissions rather than cryptographic weaknesses. An attacker gained control of the upgrade authority for the staking contract and drained 8.591 million B2 tokens.

The data tells a stark story. In July, 14 protocol-related security incidents occurred, down from 67 in June, but the average loss per incident rose significantly. Total losses in July increased by approximately 18.7% month-over-month compared to $81.73 million in June. Of the $97 million lost, $94 million was attributed to hacker attacks and smart contract vulnerabilities, while $3 million resulted from phishing attacks.

Phishing attacks, though smaller in aggregate, also targeted Ethereum users directly. On July 9, victims signed a phishing token approval on Ethereum, losing $999,999 in USDT. On July 24, victims lost $340,463 due to a phishing multi-call attack on Ethereum, with 332,787 alphaUSDCDeltaV2 tokens drained just 36 seconds after the victim signed the malicious transaction.

Summer.fi, an Ethereum DeFi yield optimization protocol formerly known as Oasis.app, also suffered a breach on July 6. Its FleetCommander vault lost approximately $6.04 million due to a vault configuration vulnerability. The flaw stemmed from the totalAssets() calculation including strategy components that had been set with deposit caps and were scheduled for deactivation but had not yet been removed from the active pool.

The broader implication is clear: as Ethereum and the Web3 ecosystem mature, the security perimeter has expanded far beyond smart contract code. Developers, exchanges, and protocols must now secure price feeds, bridge infrastructure, governance systems, and key management processes with the same rigor they apply to on-chain logic. The attackers have already adapted. The question is whether the industry can keep pace.