Zero Hour Tech’s Monthly Security Incident Roundup is here! According to statistics from multiple blockchain security monitoring platforms, the security landscape of the cryptocurrency industry in July 2026 was characterized by “accelerated shifts in attack vectors, with off-chain infrastructure becoming the new focal point.” Total losses due to security incidents that month amounted to approximately $97 million, with $94 million attributed to hacker attacks and smart contract vulnerabilities, and $3 million resulting from phishing attacks. More than 14 protocol-related security incidents occurred, a decrease from 67 in June, but the average loss per incident rose significantly. Total losses in July increased by approximately 18.7% month-over-month compared to $81.73 million in June. Cross-chain bridges remained the primary target, with multiple attacks—including those on AFX Trade, Verus, and B² Network—occurring in rapid succession within hours, collectively resulting in losses exceeding $35 million. Attack vectors are rapidly shifting away from smart contract code vulnerabilities toward non-code-based methods such as off-chain infrastructure compromise, signature key exposure, and governance vote manipulation.
Regarding hacker attacks
Seven typical security incidents
• Ostium Off-chain Oracle Privilege Compromise
Time: July 15
Loss amount: approximately $23.75 million
Event Details: Ostium, an RWA perpetual trading protocol on the Arbitrum ecosystem, was attacked. The attacker gained access to the off-chain price signing system, fabricated BTC/USD price data, manipulated the BTC price to approximately $5,000, and stole around $23.75 million USDC from the OLP liquidity pool through circular opening and closing of positions. The official team confirmed that this incident was not caused by a smart contract vulnerability or a compromised governance multisig, but rather by a breach of the off-chain price signing infrastructure. User margins were unaffected, and trading resumed on July 23.
• AFX Trade Cross-Chain Bridge Verification Key Compromise Attack
Time: July 22
Loss amount: approximately $24.15 million
Event Details: The cross-chain bridge operated by AFX Trade, a decentralized perpetual futures exchange on the Arbitrum ecosystem, was compromised. The attacker gained access to the private signing key of the bridge’s validator nodes and used it to authorize withdrawals. Since the smart contract properly validated the signatures and released funds as designed, there were no vulnerabilities at the contract level. Approximately 24.15 million USDC were bridged from Arbitrum to Ethereum and exchanged for 12,467.5 ETH at an average price of $1,937, consolidated into a single wallet. The native Arbitrum bridge was unaffected. AFX has suspended the compromised cross-chain bridge and offered the attacker a 30% bounty to recover the stolen funds.
• BonkDAO governance voting manipulation attack exploiting access control vulnerability
Time: July 6
Loss amount: approximately $20 million
Event Details: The attacker spent approximately $4 million to acquire a sufficient quantity of BONK tokens, exploiting the Solana Realms governance platform’s mechanism that allows proposals to pass with only a 1% voting threshold. The attacker submitted and passed a malicious proposal. After the proposal was approved on July 6, the attacker transferred approximately 44.26 billion BONK tokens (around $20 million) from the BonkDAO treasury. No smart contract vulnerabilities were exploited—the flaw lay not in the contract code, but in the governance rule design itself. Immunefi noted that this is a classic example of the most severe loss event of 2026: funds were not lost due to contract defects, but through governance voting and flawed rule design.
• Bonzo Lend Oracle Manipulation Attack
Time: July 11
Loss amount: approximately $9.05 million
Event Details: Bonzo Lend, the largest lending protocol in the Hedera ecosystem, suffered an oracle manipulation attack. The attacker exploited a signature validation vulnerability in Supra, a third-party oracle provider, to inject manipulated price data for the SAUCE token. By artificially inflating the value of collateral, the attacker borrowed assets far exceeding the actual collateral value before the oracle corrected the data, resulting in approximately $9.05 million in losses. The protocol has suspended all activities, and Bonzo Labs and the Bonzo Finance Foundation are coordinating recovery and remediation efforts.
• Verus – Second attack on the Ethereum cross-chain bridge
Time: July 23
Loss amount: approximately $7.55 million
Event Details: The Verus-Ethereum cross-chain bridge was attacked again, resulting in losses of approximately $7.55 million. This attack exploited the same contract pathway and vulnerability class as the May attack, highlighting how unpatched flaws and redeposited funds leave systems vulnerable to secondary attacks. The vulnerability falls under the category of cross-chain bridge verification bypass, with attackers stealing funds through the same entry point.
• B² Network Staking Contract Upgrade Permission Attack
Time: July 23
Loss amount: approximately $3.86 million
Event Details: An attacker gained control of the upgrade authority for the staking contract on B² Network on BNB Chain, resulting in the loss of approximately 8.591 million B2 tokens (around $3.86 million). The attacker exchanged these tokens for 5,409 WBNB (approximately $3.11 million) and bridged them to Ethereum, and is currently using NEAR Intents to transfer the funds to Zcash. This incident underscores that compromised keys and permissions—rather than cryptographic technology itself—remain the primary cause of major cryptocurrency thefts. The team has suspended staking functionality and has contacted the attacker on-chain, stating that if at least 10% of the stolen funds are returned within 24 hours, no legal action will be initiated.
• Summer.fi Vault Configuration Vulnerability Attack
Time: July 6
Loss amount: approximately $6.04 million
Event Details: The FleetCommander vault of the Ethereum DeFi yield protocol Summer.fi was compromised. The vulnerability stemmed from the totalAssets() calculation including strategy components that had been set with deposit caps and were scheduled for deactivation but had not yet been removed from the active pool. Attackers exploited this calculation discrepancy to accumulate assets and withdraw excessive yields. Summer.fi, formerly known as Oasis.app, was launched in 2019 for MakerDAO users and transitioned to an AI-driven automated yield optimization layer in early 2026.
Rug Pull / Phishing Scam
Four typical security incidents
(1) On July 9, victims with addresses starting in 0x8c94 signed a phishing token approval on Ethereum, resulting in the loss of $999,999 in USDT.
(2) On July 24, victims with addresses starting in 0x3e1b lost $340,463 due to a phishing multi-call on Ethereum.
Timeline:
06:51:47 UTC — The victim signed a multicall() on the alphaUSDCDeltaV2 token contract, which contained an unlimited approve() allowance.
06:52:23 UTC — 36 seconds later, 332,787 alphaUSDCDeltaV2 (~$340K) were depleted via transferFrom.
(3) Phishing attack using a counterfeit SecondFi mobile application
Loss amount: approximately $14.2 million
Incident Type: On July 12, a global cryptocurrency security monitoring platform disclosed three high-severity attacks targeting crypto assets. The first involved phishing attacks via counterfeit mobile applications impersonating SecondFi, primarily targeting developers. All three attacks erupted within a 24-hour window, affecting developers, retail users, and high-net-worth whales, revealing systemic security vulnerabilities across the entire Web3 ecosystem.
(4) Ledger physical letter phishing scam
Loss amount: approximately $960,000
Incident Type: Between July 3 and July 7 (peak period), a scam group mailed counterfeit official letters from Ledger to users’ addresses. The letters featured Ledger’s official logo, a signature from the CTO, and details about a post-quantum cryptography security update, prompting users to scan a QR code leading to a highly convincing phishing site where they were tricked into entering their recovery phrases, resulting in theft of wallet assets. Queensland Police confirmed that, during this period alone, reported losses exceeded AUD 1.47 million. Authorities warn that Ledger will never request your recovery phrase via mail or phone.
Summary
The core characteristics of blockchain security incidents in July 2026 can be summarized by three keywords: shifted attack vectors, persistent cross-chain bridge compromises, and heightened governance vulnerabilities.
The attack surface is undergoing a significant shift: non-code-based attack methods—such as off-chain infrastructure compromises, signature key leaks, and governance vote manipulation—are rapidly increasing in prevalence. In the AFX Trade incident, attackers withdrew $24.15 million simply by obtaining a signature key; the Ostium incident revealed that off-chain access controls lack security measures equivalent to on-chain multisignature protections; and the BonkDAO incident demonstrated that governance voting mechanisms themselves can serve as entry points for attacks.
Regarding phishing scams, this month saw multiple attacks adopting a new pattern: "compromising high-profile accounts + promoting fake tokens," directly turning brand trust into a tool for fraud. Authorization-based phishing has evolved from one-time scams into a replicable, automated process for stealing funds.
Zero Time Technology Security Team recommends:
• Individual: Be cautious of sudden "official" token promotions on Platform X; avoid clicking on unknown links or signing requests; regularly revoke wallet authorizations; use separate wallets to isolate risk for high-value assets.
• Project Team: Off-chain infrastructure access control must meet the same security standards as on-chain multisignature; validator keys must use multisignature combined with hardware signing; governance proposals must have higher voting thresholds and time locks; establish 24/7 monitoring and circuit breaker mechanisms; audit must cover the entire chain of key storage, permissions, and governance rules.
• Industry: Establish industry standards for cross-chain bridge key management; promote standardization of off-chain infrastructure security audits; enhance APT threat intelligence sharing and blacklist database development; recommend that projects implement bug bounty programs.