The cryptocurrency sector suffered approximately $97 million in losses during July 2026, marking an 18.7% month-over-month increase from June. But the headline number masks a more unsettling trend: hackers are systematically abandoning attacks on smart contract code in favor of off-chain infrastructure breaches, signature key leaks, and governance manipulation. This shift means that even protocols with pristine audit reports remain vulnerable to catastrophic theft.

Why Are Attackers Abandoning Smart Contract Exploits?

For years, the crypto industry has treated security audits as a kind of insurance policy. A protocol passes a code review, and the community assumes it is safe. July's incidents shatter that assumption. Of the approximately $94 million in hacking losses that month, the vast majority stemmed not from contract vulnerabilities but from compromised infrastructure, leaked keys, and flawed governance design.

The Ostium attack illustrates this perfectly. On July 15, attackers gained access to Ostium's off-chain price signing system, the infrastructure that feeds real-world price data into the protocol. By forging Bitcoin price data and manipulating the BTC/USD rate to approximately $5,000, the attacker stole approximately $23.75 million in USDC from the liquidity pool. Ostium's smart contracts worked exactly as designed; the vulnerability existed entirely outside the code.

Similarly, AFX Trade's cross-chain bridge fell victim to a private validator signature key leak on July 22. The attacker obtained the bridge's signing credentials and used them to authorize withdrawals of approximately $24.15 million in USDC. Again, no contract flaw existed. The smart contract verified the signature and released funds as intended. The problem was key management, not code.

What Types of Non-Code Attacks Dominated July?

The shift in attack vectors reveals how attackers are becoming more sophisticated in targeting the human and operational layers of blockchain infrastructure. Rather than hunting for mathematical flaws in contract logic, they are exploiting organizational weaknesses, governance loopholes, and the trust assumptions built into protocol design.

• Off-Chain Infrastructure Breaches: Attackers compromised price signing systems and oracle providers, injecting false data into protocols. Bonzo Lend lost approximately $9.05 million when attackers exploited a signature verification vulnerability in the Supra oracle provider to inflate collateral values.
• Governance Vote Manipulation: BonkDAO suffered a $20 million loss when an attacker spent approximately $4 million to purchase enough BONK tokens to pass a malicious proposal. The Solana Realms governance platform allowed the proposal to pass with just 1% voter turnout, exposing a design flaw rather than a code bug.
• Compromised Keys and Permissions: B² Network lost approximately $3.86 million when attackers seized upgrade permissions for the staking contract. Verus experienced a second attack on its Ethereum bridge using the same unpatched vulnerability from a May incident, highlighting how re-deposited funds can remain exposed to secondary attacks.
• Treasury Configuration Errors: Summer.fi's FleetCommander vault was exploited for approximately $6.04 million due to a calculation discrepancy in the totalAssets() function, which still included strategy components scheduled for decommissioning.

Cross-chain bridges proved especially vulnerable. AFX Trade, Verus, and B² Network were attacked in rapid succession within hours, resulting in combined losses exceeding $35 million. These incidents underscore how bridges, which move assets between different blockchains, have become prime targets because they sit at the intersection of multiple systems and often rely on centralized key management.

How Can Projects Protect Against Infrastructure Attacks?

Traditional security audits, which focus on smart contract code, cannot detect or prevent the types of attacks that dominated July. Projects need a broader security posture that extends beyond code review into operational security, key management, governance design, and off-chain infrastructure monitoring.

• Implement Decentralized Key Management: Distribute signing authority across multiple parties and use threshold cryptography so that no single compromised key can authorize large transactions. AFX Trade's reliance on a single validator signature key made it an attractive target.
• Audit Governance Mechanisms: Review voting thresholds, quorum requirements, and proposal execution delays. BonkDAO's 1% voter turnout requirement allowed an attacker to pass a malicious proposal with a relatively modest capital investment.
• Monitor Off-Chain Infrastructure: Establish continuous monitoring of oracle providers, price feeds, and data signing systems. Implement circuit breakers that pause protocol activity if price data deviates abnormally from expected ranges.
• Diversify Treasury Holdings: Projects holding large portions of their treasury in their own tokens face compounded risk. A 61% token price decline, which Immunefi research shows is typical after a major hack, can eliminate the financial resources needed for recovery precisely when security and customer support costs are rising.
• Develop Incident Response Plans: Create clear procedures for pausing affected systems, communicating with users, and coordinating recovery efforts. Ostium resumed trading on July 23, just eight days after the attack, demonstrating the value of preparation.

The data suggests that security must be addressed before deployment rather than treated as an emergency expense after an exploit. Immunefi's research on hacked tokens found that approximately 84% of affected tokens remained below their pre-incident prices six months after an attack, with a median decline of 61%. This long-term damage extends far beyond the initial theft, affecting the project's ability to fund development, compensate users, and maintain community confidence.

What Does This Mean for Crypto Users and Investors?

The July incidents carry implications that extend beyond protocol developers. The shift toward infrastructure and governance attacks suggests that even well-audited projects face significant risk. Users cannot assume that a protocol's security audit guarantees safety; they must also evaluate the project's key management practices, governance design, and operational security.

Additionally, the concentration of losses among a small number of catastrophic incidents reveals that attackers are becoming more selective and more effective. Immunefi examined 425 publicly disclosed incidents between 2021 and 2025, involving combined losses of approximately $11.9 billion. The five largest exploits during 2024 and 2025 represented 62% of all stolen funds during those two years, and the largest ten accounted for 73%. This concentration reflects the economic logic of attackers; a successful compromise of one large custodian or bridge can provide access to assets belonging to thousands or millions of users.

The Coldcard hardware wallet vulnerability, which reportedly involved affected devices generating predictable rather than genuinely random private keys, further complicates the security landscape. The incident challenged the assumption that moving assets from an exchange into a hardware wallet automatically removes custodial risk. Galaxy Research linked the vulnerability to the theft of more than 1,300 Bitcoin, with confirmed losses above $100 million. This prompted record inflows to centralized exchanges as users reconsidered the risks of self-custody.

July's $97 million in losses represents not just a financial setback but a fundamental shift in how attackers operate. The crypto industry's focus on code audits and smart contract security has created a blind spot in operational and governance security. Until projects address these broader vulnerabilities, the pattern of large-scale breaches is likely to continue, regardless of how thoroughly their contracts have been reviewed.