Crypto hacks reach $110M in July as 2026 trends toward record losses

Large-scale exploits defined the month, most notably the $23.75 million breach at Ostium, where attackers manipulated price data, and a $24.15 million bridge exploit at AFX. These incidents underscore the vulnerability of off-chain infrastructure and cross-chain bridges. Through early August, Immunefi tracked 164 separate hacks, with 67 of those incidents exceeding $1 million in losses each. This follows a broader $1.1 billion loss recorded during the first half of the year.

To counter these threats, firms are shifting toward competitive security models. Immunefi’s data shows that audit competitions uncover an average of 6.2 serious vulnerabilities per engagement, significantly outperforming private tier-1 audits, which often return a median of zero critical flaws. These competitive reviews cost approximately $6,548 per identified vulnerability, a fraction of the $66,000 typically spent on private audits. The disparity is even sharper when compared to the $24.5 million average cost incurred when an attacker discovers a flaw first.

Researchers are increasingly utilizing AI to scan code, contributing to an 18% rise in confirmed bug bounty reports in July. Immunefi paid out $2.32 million in rewards last month, bringing its cumulative total to $143.1 million. Despite this increased activity, the sheer volume of attacks suggests that traditional security audits are no longer sufficient. As 2026 approaches a record for major incidents, the industry is moving toward continuous, competitive security assessments to bridge the gap between preventive research and live exploitation.