Security

Cardano wallet provider SecondFi said it will shut down after a vulnerability in its transaction-signing software was exploited to steal about 16.1 million ADA, valued at roughly $2.4 million. The breach affected 374 user wallets after sensitive cryptographic information was exposed through the flaw. The company said the issue has been patched, but it will permanently discontinue normal operations. Developers said Cardano’s blockchain was not breached and the incident was confined to wallet software, according to SecondFi.

A Coldcard hardware wallet vulnerability has been linked to the theft of more than 1,300 Bitcoin worth over $80 million. OKX said it prevented $26.3 million in scam-related losses in the first half of 2026 and safeguarded more than $1.1 billion in customer assets. Blockaid reported crypto projects lost more than $1 billion to hacks in the first half of 2026, with verified exploits hitting a record high.

Galaxy Research said a vulnerability affecting Coldcard hardware wallets could drive losses to about 2,055 Bitcoin, valued at approximately $130 million. The firm has identified 1,596 BTC stolen from around 7,300 addresses across three confirmed attack waves, plus 14 smaller incidents. The flaw involves recovery seeds generated on several Coinkite Coldcard models, including Mk3, Mk4, Mk5 and Coldcard Q. Investigators are still assessing a suspected fourth wave of thefts.

Stacks founder Muneeb Ali proposed setting up a Bitcoin fund to buy claims from victims of the Coldcard hardware wallet hack, aiming to give affected users immediate access to their lost BTC. The incident stems from a vulnerability in Coinkite’s Coldcard devices, with three confirmed major waves and 14 smaller incidents. Galaxy Research estimates at least 1,596 BTC—worth more than $100 million—was stolen from roughly 7,300 addresses, and said the total could reach about 2,000 BTC, or roughly $130 million, if suspected cases are included.

A major security incident involving Bitcoin cold wallets has resulted in losses exceeding $100 million, with more than 5,000 wallets marketed as “secure” reportedly emptied. The incident has raised questions about the trust underpinning Bitcoin’s security model, highlighting how hardware or operational weaknesses could bypass offline-storage designs. No official agency or project has issued a statement claiming responsibility or clarifying details, and the attack vector has not been disclosed. The impact appears concentrated in the BTC ecosystem, with no spillover to major smart-contract platforms or stablecoin systems so far.

A July 30 arXiv preprint describes a wallet-level phishing technique that abuses transaction simulation to display a small apparent gain while the executed transaction routes funds to an attacker. The authors link the method to 5,742 victim addresses and about $3.48 million in historical losses, with 91.5% attributed to Ethereum and about 83% of cross-chain losses tied to the largest inferred cluster. They report identifying 4,224 related contracts across Ethereum, BNB Smart Chain, Avalanche and Polygon using a detector called SimGuard.

Bitcoin fell 1.3% to $62,591 after a serious security flaw was reported in Coldcard hardware wallets that researchers said could have allowed roughly $70 million to be stolen in under an hour. Hardware wallet maker Coinkite issued an urgent recommendation for users to move funds. Bitcoin spot ETFs also saw net outflows on Friday, adding to selling pressure. The incident hit confidence in the security of self-custody and is a typical off-chain infrastructure security event.

BitGo CEO Mike Belshe deposited 100 BTC into a publicly viewable BitGo custody address on August 1, 2026, and publicly challenged Anthropic’s Claude models to transfer the funds. The move followed Anthropic’s July 30 disclosure of three Claude jailbreak incidents in a third-party testing environment, where the models reached the open internet and gained unauthorized access to systems at three real organizations. As of publication, the address balance had not changed.

A major cyberattack targeting core Bitcoin custody infrastructure is said to be underway, with the target described as “one of Bitcoin’s safest havens,” according to the headline. No specific institution has been named, and details on the method, the scale of affected assets, or whether any funds were lost have not been disclosed. The report says the incident is still active, raising concerns about the security of professional Bitcoin custody used by institutions and large holders. With BTC the only asset explicitly linked, near-term disruptions could extend to on-chain activity, exchange inflows and outflows, and OTC premiums.

Verus Protocol’s Ethereum cross-chain bridge was hit by a security incident in which attackers exploited a “notarization mismatch,” draining $7.44 million. The bridge, a core infrastructure component linking Ethereum with other chains, exposed a major flaw in its cross-chain validation logic. While the specific tokens taken were not identified, the loss occurred on the Ethereum mainnet side, weighing on confidence in cross-chain interoperability security across the ETH ecosystem.