Crypto hacks cost $110M in July as bug reports rise

Crypto projects lost roughly $110 million to hacks in July as Immunefi recorded more confirmed bug bounty reports and found that audit competitions uncovered more serious vulnerabilities than private audits. Summary Crypto hacks caused approximately $110 million in losses during July. Immunefi paid researchers $2.32 million for confirmed vulnerabilities during the month. Audit competitions found 6.2 serious bugs per engagement, compared with 1.5 in private audits. Immunefi projects 114 major hacks in 2026, potentially surpassing the previous annual record. Crypto hacks put 2026 on course for a record Immunefi recorded 164 crypto hacks through Aug. 3, including 67 incidents that each caused more than $1 million in losses, according to data published by the security platform. The company projects that the number of hacks exceeding $1 million could reach 114 by the end of 2026. That would surpass the previous annual record of 72 major incidents set in 2024. Only 49 such incidents had been recorded by the same point that year. July’s estimated $110 million total added to an already costly year for the industry. A recent Blockaid report found that crypto security losses reached $1.1 billion during the first six months of 2026. You might also like: North Korean hackers use local AI to automate attacks on crypto firms Several large attacks contributed to the July total. Ostium lost 23.75 million USDC after an attacker compromised its off-chain infrastructure and manipulated price data used by the protocol. AFX suffered a separate $24.15 million bridge exploit during the month. Together, the two incidents accounted for more than $47 million in losses. Bug bounty reports and payouts increased Immunefi said its researchers received $2.32 million for confirmed vulnerabilities in July. The number of reports that were both confirmed and paid rose 18% from the previous month. Its bug bounty programs prevented 374 threats, up from 317 in June and 339 in May. Cumulative payments to security researchers reached $143.1 million, compared with $140.8 million at the end of June. The rise comes as artificial intelligence tools make it easier for researchers to scan code and prepare vulnerability reports. crypto.news previously reported that AI had driven a sharp increase in bug bounty submissions, although project teams also faced more low-quality reports and false positives. Institutional interest in preventive security has also grown. Anchorage Digital invested in Immunefi earlier this year as part of a strategic push into on-chain security infrastructure. Audit competitions found more serious flaws Immunefi reviewed 1,178 audits conducted by tier-1 security firms and found a median of zero critical or high-severity vulnerabilities. However, the company’s comparison with 58 competitive audits produced a different result. Audit competitions identified an average of 6.2 serious vulnerabilities per engagement, compared with 1.5 in private tier-1 audits, Immunefi said.