Crypto Security Violations: $247 Million Stolen in July, the Second Worst Month

July 2026 will go down in history as one of the darkest months for digital security in the sector. In just thirty days, $247 million in cryptocurrencies were stolen, making this month the second worst ever recorded for crypto thefts. The crypto security violations during this period did not stem from a single isolated event, but rather from a combination of infrastructural flaws and increasingly sophisticated attacks, partly assisted by artificial intelligence.

Summary

• Key Points
• The crypto security violations of July 2026 reveal infrastructural flaws
  • Exploitation of the Coldcard hardware wallet leads to significant losses
  • The complexity of security in crypto transactions
• AI attacks intensify threats in the crypto world
  • Use of AI by UNC1069 for phishing and deepfakes
  • The role of AI in accelerating traditional attack methods
• New dynamics in crypto liquidity and asset tokenization
  • Growth of tokenized US Treasuries as on-chain liquidity
  • Decline in DeFi TVL and growth in the real asset market
• FAQ
  • What caused the major crypto thefts in July 2026?
  • How does artificial intelligence affect crypto security attacks?
  • What drives the growth of tokenized US Treasuries?
  • Why is DeFi's TVL declining while real assets are growing?

Key Points

• In July 2026, $247 million in crypto were stolen, marking the second worst month ever recorded for thefts in the sector.
• The flaw in the Coldcard hardware wallet was the main contributor to the losses.
• The North Korean group UNC1069 used artificial intelligence, including Gemini, for phishing, reconnaissance, and deepfake videos against figures in the crypto sector.
• The supply of tokenized US Treasuries reached $15.3 billion, while DeFi's TVL dropped by about 54% from its peak.
• The market capitalization of tokenized real-world assets (RWA) has grown by over 550% since 2025.

The crypto security violations of July 2026 reveal infrastructural flaws

The figure of $247 million stolen only tells part of the story. More than any other factor, the exploit that affected Coldcard, the Bitcoin-only hardware wallet produced by the Canadian company Coinkite, demonstrated that even tools designed to protect users can become a systemic breaking point for the entire ecosystem.

Exploitation of the Coldcard hardware wallet leads to significant losses

The Coldcard exploit was the main contributor to the losses in July. The vulnerability exposed thousands of users to significant risks, showing how a flaw at the hardware device level can simultaneously affect numerous seemingly independent wallets. Coinkite has released a corrected firmware, but wallets with vulnerable seeds require a complete migration to new keys.

The complexity of security in crypto transactions

The Coldcard incident clearly illustrates why merely protecting private keys is no longer sufficient. A modern crypto transaction traverses multiple layers: hardware wallets, firmware, wallet software, frontend interfaces, smart contracts, bridges, oracles, RPC providers, and third-party libraries. Each additional link introduces a new potential point of compromise, and this specific case demonstrates how a vulnerability at the hardware device level can simultaneously affect thousands of users who appear to be independent of one another.

AI Attacks Intensify Threats in the Crypto World

While infrastructural flaws remain the most visible factor behind the losses in July, a second element is changing the face of crypto security breaches: the increasing use of artificial intelligence by organized attack groups.

Use of AI by UNC1069 for Phishing and Deepfake

The North Korean group UNC1069, which specifically targets the cryptocurrency sector, has exploited Gemini for reconnaissance activities, seeking data on wallets, creating materials for social engineering campaigns, and attempting to develop code aimed at stealing cryptocurrencies. The same group has employed deepfake images and videos that mimic well-known figures in the crypto industry, aiming to convince victims to install a malicious Zoom SDK.

The Role of AI in Accelerating Traditional Attack Methods

Artificial intelligence does not necessarily create entirely new vulnerabilities, but it makes phishing, reconnaissance, impersonation, and malware development much easier to scale. This is an important distinction: AI does not invent new entry points but makes existing attacks faster, more convincing, and harder to detect, adding an additional layer of risk to an already complex security stack.

This dynamic changes the risk calculation for those operating in the sector. Defenses designed to block manual or small-scale attacks may no longer suffice against automatically generated and adapted campaigns capable of simultaneously targeting multiple victims with tailored material.

New Dynamics in Crypto Liquidity and Asset Tokenization

As security remains under pressure, on-chain capital is changing direction. The growth of tokenized real-world assets (RWA) intertwines with a slowdown in traditional DeFi, marking a structural shift in the liquidity of the entire sector.

Growth of Tokenized US Treasuries as On-Chain Liquidity

The supply of tokenized US Treasuries has reached $15.3 billion, with USYC, BUIDL, and USDY as the main reference assets. Their value proposition is relatively straightforward: investors can maintain on-chain liquidity while simultaneously gaining exposure to short-term US government debt, instead of leaving capital idle in stablecoins. This makes them particularly attractive when the native yields of crypto lose competitiveness. The more capital flows into these instruments, the more tokenized Treasuries risk becoming a true layer of collateral and base liquidity for on-chain finance, rather than just another RWA category among many.

Decline of TVL in DeFi and Growth of the Real Asset Market {#Decline_of_TVL_in_DeFi_and_Growth_of_the_Real_Asset_Market}

The total TVL of DeFi has decreased by about 54% from its recent peak, while the market capitalization of real assets (RWA) has risen by over 550% since 2025. Part of the decline in TVL simply reflects the drop in the price of ETH and other assets that make up a significant portion of the total locked value. But there is also a second factor: reduced activity in DeFi has lowered the yields of lending protocols and other products, pushing capital towards low-risk alternatives with comparable returns, such as tokenized U.S. Treasury securities.

The more these assets integrate into lending, collateral, and liquidity markets, the more DeFi will find itself competing not only with other crypto protocols but also with the yields of traditional finance brought on-chain. It is a shift in the landscape that could reshape the balance of power between native crypto protocols and tokenized financial instruments derived from traditional assets.

FAQ {#FAQ}

What caused the major crypto thefts in July 2026? {#What_caused_the_major_crypto_thefts_in_July_2026}

The defect in the Coldcard hardware wallet was the most significant contributor, exposing vulnerabilities present even in an infrastructure designed specifically for security.

How does artificial intelligence impact crypto security attacks? {#How_does_artificial_intelligence_impact_crypto_security_attacks}

AI accelerates and scales traditional attack methods such as phishing and impersonation through deepfake, but does not create entirely new vulnerabilities.

What drives the growth of tokenized U.S. Treasuries? {#What_drives_the_growth_of_tokenized_U.S._Treasuries}

Their strength lies in offering on-chain liquidity with exposure to short-term U.S. public debt, a particularly evident advantage when native crypto yields become less competitive.

Why is DeFi's TVL declining while real assets are growing? {#Why_is_DeFi's_TVL_declining_while_real_assets_are_growing}

The decline in asset prices and weaker DeFi yields push capital towards lower-risk alternatives, such as tokenized Treasuries, while the real asset market continues to expand.

Content created with the assistance of artificial intelligence and human editorial review.