theft

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

In 2025, the amount of cryptocurrency theft reached $3.4 billion, with Bybit suffering a loss of $1.5 billion, accounting for 44% of the total for the year. In the first half of 2026, there were 212 related incidents, resulting in losses of approximately $1.1 billion, with about 55% involving the Lazarus-linked group. KelpDAO was attacked in April, resulting in a loss of $293 million.Stolen funds typically undergo a three-phase transfer process lasting about 45 days: the first 5 days involve exchanging through DeFi protocols and entering mixing services, followed by cross-chain bridging and flowing through trading platforms with lower KYC requirements. During the 20 to 45 days period, funds are further cashed out in batches through non-KYC platforms, instant exchangers, and over-the-counter trading networks. Once funds cross multiple blockchains, mixing services, and jurisdictions, tracking may still be possible, but the difficulty of recovery significantly increases. The recovery rate of stolen funds from Bybit is less than 5%; Tether and Circle can freeze USDT and USDC addresses, and attackers typically exchange stablecoins for Ethereum or Bitcoin within minutes after the attack.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

According to monitoring by the head of Galaxy Research, less than 1 BTC was stolen overnight through a victim's report, identifying a new attack where the attacker transferred 12 BTC from 126 addresses, with the attack footprint marked as "footprint O."

According to Bits Media, Russian law enforcement conducted a series of searches at a cryptocurrency exchange office located in the Federal Eastern Tower of the Moscow City Business Center. The police stated that the searches are related to a theft case involving 144 million rubles, with the funds suspected to have been circulated through related exchanges. They are currently tracking the transactions and investigating whether the office staff are involved.During the investigation, dozens of employees were detained, and a Moscow court has ordered pre-trial detention for eight of the defendants, while the procedural status of the remaining detainees has not been disclosed. The office temporarily ceased operations during the searches.

In the security incident involving Coldcard, a hardware wallet company under Coinkite, the amount of stolen Bitcoin has risen to approximately 1359.882 coins. The Coldcard Sweep Watch dashboard statistics show that most of the identified Bitcoin still remains in a few addresses controlled by the attacker.On August 1, a holding address of the attacker received a transaction containing OP_RETURN information. This information publicly offered "cleaning" Bitcoin, KYC assistance, and cash-out services for a 10% fee, along with a Telegram contact.Coinkite has released an emergency firmware update to eliminate the weak random number generation issue that caused the original vulnerability. The company stated that the new firmware only protects wallets created in the future and cannot fix seeds generated in the affected versions.Some users reported that after installing the update, their devices remained on an error page, failed to start, or appeared to be bricked, mainly involving Mk4 and Q devices, with some Mk3 users reporting similar issues. As of August 2, Coinkite has not publicly confirmed the existence of widespread firmware defects.

The Slow Mist security team issued an alert that an unverified contract exposed an unrestricted low-level call vulnerability due to selector 0x42be3129, lacking access control and target data validation, resulting in approximately 16.6 WETH being stolen.The attacker exploited the existing ERC20 allowance of the contract to bypass the owner check and execute unauthorized transferFrom operations.

According to monitoring by Blockaid, Garden's HTLC is currently under attack, with approximately $450,000 USDT stolen on Ethereum, Base, Arbitrum, and BNB Chain.In response, Garden tweeted that they have detected unusual activity, temporarily shut down the application, and launched a comprehensive investigation. More information will be released later.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

Cardano ecosystem wallet SecondFi stated that approximately 16.1 million ADA were stolen due to a vulnerability in the wallet software, valued at about 2.6 million USD. The platform will gradually shut down SecondFi and Yoroi wallet services. This incident affected 374 wallets.SecondFi indicated that an independent investigation by blockchain intelligence agency Groom Lake identified the attacker as a sophisticated external actor and found indicators possibly related to North Korea's Lazarus Group, but attribution has not yet been confirmed. SecondFi is developing a recovery tool based on zero-knowledge proofs to help affected users recover their assets and limit the information that needs to be shared. The tool is still in testing and will undergo third-party auditing before its planned release in August. SecondFi is also preparing a wallet export feature that allows users to migrate their assets to other services. The platform has not announced a direct compensation plan and has not specified whether it will use its own funds to compensate users.

According to official news, PinGo announced that its reward contract was recently attacked by hackers. The hackers exploited a vulnerability in permission verification to illegally claim 840,000 PINGO tokens.PinGo officials pointed out that this security incident has been effectively controlled, the remaining assets have been successfully migrated, and the upgrade of the related contract has also been completed. The officials emphasized that the PINGO tokens and related private keys are still in a secure state, and the reward claiming function has now been reopened.

Dragonfly partner Haseeb responded on Twitter to OpenZeppelin co-founder Manuel Aráoz's previous pessimistic view on DeFi security, stating that with models like GLM 5.2, Fable, and GPT 5.6 now online and actively used by attackers, DeFi has not experienced the anticipated "hacker apocalypse."Chart data shows that based on current year-to-date figures and operating rates, the annualized amount stolen in DeFi by 2026 is approximately $1.89 billion, with a cumulative theft of about $986 million this year, which is lower than the levels of 2025 and still within historical ranges.Haseeb believes that the deeper change currently is that while the number of hacker attacks has increased, the scale of individual attacks has decreased more rapidly, with attackers increasingly targeting smaller protocols and abandoned projects, while larger protocols have completed more security enhancements, thus the overall safety of funds has not significantly worsened.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that "isolation mode" will be launched this week, allowing users to check if their wallet addresses are involved in the related incident and submit tickets; next week, they plan to introduce a secure wallet export feature to provide a safer wallet migration path for users of different technical levels.SecondFi reiterated that it will provide potential asset recovery solutions for wallets confirmed to be affected through the process, expected to use a zero-knowledge proof-based recovery tool with set qualifications and terms; the official also reminded users that they will not request private keys or mnemonic phrases, and users should only operate through official website support and designated verification tools.

BonkDAO disclosed on platform X that it suffered a malicious governance proposal attack, resulting in approximately 20 million dollars worth of BONK tokens being stolen from the BonkDAO treasury.BonkDAO stated that during the investigation, the attacker was identified using an exchange wallet to purchase BONK before the proposal was initiated, and they are currently collaborating with exchanges, cross-chain bridges, and the Solana Foundation. Additionally, the team has notified law enforcement and continues to work with relevant parties to recover funds and trace the responsible individuals.

The security company Coinspect Security posted on platform X that by analyzing cryptocurrency wallet seeds generated with insecure code since 2018, they discovered that thousands of seeds had been actually used. Just last month, it was found that the amount stolen from these wallets reached up to 3.14 million dollars, most of which went unreported.Some funds were concentrated into a single address and exhibited money laundering patterns. One affected address transferred out 2 million dollars just hours after the alert was issued, and it is uncertain whether this was theft. Coinspect warns that users who believe many assets are still at risk may be located in China.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.

Taiko officially stated on X: "We have identified the root cause of this attack and are currently developing a fix to restore the blockchain's online operation as soon as possible. At the same time, we are working closely with major exchanges and security partners to track and freeze the hacker's assets. The remaining funds in the cross-chain bridge are currently safe, and we will announce the next steps in our upcoming updates. To focus on fixing the vulnerabilities and protecting user assets, we will pause updates for a few hours."Previously, it was reported that the Taiko cross-chain bridge was attacked, with losses potentially reaching up to $1.7 million.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.