Written by: Zero Time Technology

According to statistics from multiple blockchain security monitoring platforms, the security situation in the cryptocurrency sector in July 2026 showed characteristics of "accelerated transfer of attack paths, with off-chain infrastructure becoming a new target." The total losses due to security incidents that month were approximately $97 million, with losses related to hacker attacks and contract vulnerabilities amounting to about $94 million, and phishing attacks causing a loss of about $3 million. A total of more than 14 security incidents related to protocols occurred, a decrease from 67 in June, but the loss amount per incident significantly increased. The total loss in July increased by about 18.7% compared to June's $81.73 million, with cross-chain bridges remaining hard hit. Multiple attacks on AFX Trade, Verus, B² Network, and others erupted within a few hours, with total losses exceeding $35 million. Attack paths are rapidly shifting from smart contract code vulnerabilities to off-chain infrastructure intrusions, signature key leaks, governance vote manipulation, and other non-code-level attack methods.

Hacker Attacks

Typical Security Incidents: 7

Ostium Off-Chain Oracle Permission Intrusion

Date: July 15

Loss Amount: Approximately $23.75 million

Incident Details: The RWA perpetual trading protocol Ostium in the Arbitrum ecosystem was attacked, with the attacker gaining access to the off-chain price signature system, faking BTC/USD price data, manipulating the BTC price to about $5,000, and stealing approximately $23.75 million in USDC from the OLP liquidity pool through cyclical opening and closing positions. The official confirmed that this incident was not caused by a smart contract vulnerability or a compromised governance multi-signature, but rather due to an intrusion of the off-chain price signature infrastructure. The incident did not affect users' margin, and trading resumed on July 23.

AFX Trade Cross-Chain Bridge Validator Key Leak Attack

Date: July 22

Loss Amount: Approximately $24.15 million

Incident Details: The cross-chain bridge operated by AFX Trade, a decentralized perpetual contract exchange in the Arbitrum ecosystem, was attacked. The attacker obtained the private validator signing key of the bridge and used it to authorize withdrawals. Since the smart contract validated the signature and released funds as designed, there were no vulnerabilities at the contract level. About 24.15 million USDC was stolen and cross-chained from Arbitrum to Ethereum, converting to approximately 12,467.5 ETH at an average price of about $1,937, consolidated into a single wallet. The Arbitrum native bridge was not affected. AFX suspended the attacked cross-chain bridge and offered a 30% bounty to the attacker to recover the funds.

BonkDAO Governance Vote Manipulation Attack Vulnerability Attack

Date: July 6

Loss Amount: Approximately $20 million

Incident Details: The attacker spent about $4 million to purchase enough BONK tokens and utilized the Solana Realms governance platform, which only requires a 1% voting rate to pass proposals, to submit malicious proposals and pass them. After the proposal passed on July 6, the attacker transferred about 4.426 billion BONK (approximately $20 million) from the BonkDAO treasury. There was no failure of any smart contract during the entire process; the vulnerability does not lie in the contract code but in the design of the governance rules themselves. Immunefi pointed out that this is a typical form of the most severe loss incident of 2026—funds did not flow out due to defects in the contract, but rather from governance votes and rule design.

Bonzo Lend Oracle Manipulation Attack

Date: July 11

Loss Amount: Approximately $9.05 million

Incident Details: Bonzo Lend, the largest lending protocol in the Hedera ecosystem, encountered an oracle manipulation attack. The attacker exploited a signature verification vulnerability in the third-party oracle provider Supra to inject manipulated SAUCE token prices into the protocol. By artificially inflating the collateral value, the attacker borrowed assets far exceeding the value of the collateral before the oracle corrected, resulting in approximately $9.05 million in losses. The protocol has suspended all activities, and Bonzo Labs and the Bonzo Finance foundation are coordinating recovery and remediation efforts.

Verus - Ethereum Cross-Chain Bridge Secondary Attack

Date: July 23

Loss Amount: Approximately $7.55 million

Incident Details: The Verus-Ethereum cross-chain bridge was attacked again, resulting in losses of around $7.55 million. This attack used the same contract path and vulnerability category as the one in May, highlighting how unpatched defects and redeposited funds make the system susceptible to secondary attacks. This vulnerability belongs to the type of cross-chain bridge validation bypass, with the attacker completing the fund theft through the same entry path.

B² Network Staking Contract Upgrade Permission Attack

Date: July 23

Loss Amount: Approximately $3.86 million

Incident Details: The upgrade permission of the staking contract of B² Network on the BNB Chain was seized by the attacker, resulting in losses of approximately 8.591 million B2 tokens (around $3.86 million). The attacker exchanged these for 5,409 WBNB (about $3.11 million) and then cross-chained to Ethereum, currently transferring funds to Zcash via NEAR Intents. This incident highlights that compromised keys and permissions—not the encryption technology itself—remain the main cause of significant cryptocurrency thefts. The team has suspended the staking function and has contacted the attacker on-chain, stating that if they can return at least 10% of the stolen funds within 24 hours, legal action will not be initiated.

Summer.fi Treasury Configuration Vulnerability Attack

Date: July 6

Loss Amount: Approximately $6.04 million

Incident Details: The FleetCommander treasury of the Ethereum DeFi yield protocol Summer.fi was attacked. The root of the vulnerability lay in the inclusion of strategies that had set deposit limits and were set to be offline but had not yet been removed from the active aggregate when calculating totalAssets(). The attacker exploited this calculation bias to accumulate assets and extract excess profits. Summer.fi was formerly Oasis.app, launched in 2019 for MakerDAO users, which pivoted to an AI-driven automated yield optimization layer in early 2026.

Rug Pull / Phishing Scams

Typical Security Incidents: 4

(1) On July 9, a victim with an address starting with 0x8c94 signed a phishing token authorization on Ethereum, resulting in a loss of USDT worth $999,999.

(2) On July 24, a victim with an address starting with 0x3e1b lost $340,463 due to a phishing multi-call on Ethereum.

Timeline:

06:51:47 UTC — The victim signed a multicall on the alphaUSDCDeltaV2 token contract. Inside is buried: an approve with unlimited allowance.

06:52:23 UTC — 36 seconds later, 332,787 alphaUSDCDeltaV2 (~$340K) was exhausted via transferFrom.

(3) Imitation SecondFi Fake Mobile App Phishing Attack

Loss Amount: Approximately $14.2 million

Incident Nature: On July 12, global cryptocurrency security monitoring platforms disclosed three high-harm cryptocurrency asset attack incidents. The first type was imitation SecondFi fake mobile app phishing attacks targeting developer groups. The three attacks erupted within 24 hours, covering developers, ordinary retail investors, and high-net-worth whales, exposing security weaknesses across the entire Web3 ecosystem.

(4) Ledger Physical Letter Phishing Scam

Loss Amount: Approximately $960,000

Incident Nature: From July 3 to 7 (with concentrated outbreaks), a scam gang mailed forged Ledger official physical letters to user addresses, which contained the official logo, CTO signature, and post-quantum cryptography security update instructions, inducing users to scan QR codes to enter high-fidelity phishing websites and input their mnemonic phrases, thereby stealing wallet assets. Queensland police confirmed that, from July 3 to 7, the total losses reported by victims had already exceeded A$1.47 million. Police reminded that Ledger officials would not request mnemonic phrases via mail or phone.

Summary

The core characteristics of blockchain security incidents in July 2026 can be summarized into three keywords: transfer of attack paths, continuous breaches of cross-chain bridges, and highlighted vulnerabilities in governance.

Attack paths are showing a clear shift: off-chain infrastructure incursions, signature key leaks, governance vote manipulations, and other non-code-level attack methods are rapidly increasing. In the AFX Trade incident, the attacker completed a withdrawal of $24.15 million merely by obtaining a signing key; the Ostium incident exposed the lack of off-chain permission management and protective mechanisms equivalent to on-chain multi-signatures; the BonkDAO incident indicated that the governance voting mechanism itself might become an attack entry point.

In terms of phishing scams, several attacks this month presented a new model of "high-profile account intrusions + fake token promotions," where brand trust was directly converted into a fraud tool, and authorized phishing evolved from one-time scams into a replicable automated theft process.

The Zero Time Technology security team recommends:

• Individuals: Be wary of sudden "official" token promotions on platform X; do not click unknown links or signing requests; regularly revoke wallet authorizations; use separate wallets for high-value assets to isolate risks.
• Project Teams: Off-chain infrastructure permission management must meet the same security specifications as on-chain multi-signatures; use multi-signatures + hardware signatures for validator keys; set higher voting thresholds and time locks for governance proposals; establish 24/7 monitoring and circuit breaker mechanisms; audit covering key storage, permissions, and governance rule chains.
• Industry: Establish industry standards for cross-chain bridge key management; promote the normalization of off-chain infrastructure security audits; enhance APT threat intelligence sharing and blacklist databases; encourage project teams to implement bug bounty programs.