The monthly security event highlights from Zero Hour Technology are here! According to statistics from multiple blockchain security monitoring platforms, the security landscape in the cryptocurrency field in July 2026 exhibited the characteristic of "accelerating shift in attack vectors, with off-chain infrastructure becoming the new target." The total losses caused by security events in the month were approximately $97 million, of which hacker attacks and contract vulnerabilities accounted for about $94 million in losses, and phishing attacks resulted in about $3 million in losses. Over 14 protocol-related security incidents occurred, a decrease from 67 in June, but the single-incident loss amount increased significantly. Total losses in July rose by about 18.7% month-on-month from June's $81.73 million. Cross-chain bridges remained the hardest hit area, with multiple attacks including AFX Trade, Verus, and B2 Network concentrated within hours, resulting in combined losses exceeding $35 million. Attack vectors are accelerating the shift from smart contract code vulnerabilities to non-code level attack methods such as off-chain infrastructure intrusion, signature key leaks, and governance vote manipulation.
Hacker Attacks
Typical security events: 7
• Ostium Off-Chain Oracle Authority Intrusion
Time: July 15
Loss Amount: Approximately $23.75 million
Event Details: Ostium, an Arbitrum ecosystem RWA perpetual trading protocol, was attacked. The attacker gained access to the off-chain price signature system authority, forged BTC/USD price data, manipulated the BTC price to approximately $5,000, and stole about 23.75 million USDC from the OLP liquidity pool through cyclic opening and closing of positions. The official confirmed that this incident was not due to a smart contract vulnerability or a breach of the governance multi-signature wallet, but rather an intrusion into the off-chain price signature infrastructure. User margins were not affected, and the protocol resumed trading on July 23.
• AFX Trade Cross-Chain Bridge Verification Key Leak Attack
Time: July 22
Loss Amount: Approximately $24.15 million
Event Details: The cross-chain bridge operated by AFX Trade, a decentralized perpetual contract exchange on Arbitrum, was attacked. The attacker obtained the bridge's private validator signing key and used it to authorize withdrawals. Since the smart contract verified the signature and released funds as designed, there was no vulnerability at the contract level. Approximately 24.15 million USDC was stolen and bridged from Arbitrum to Ethereum, exchanged for 12,467.5 ETH at an average price of about $1,937, and consolidated into a single wallet. The native Arbitrum bridge was unaffected. AFX suspended the attacked cross-chain bridge and offered a 30% bounty to the attacker to recover the funds.
• BonkDAO Governance Vote Manipulation & Authority Management Vulnerability Attack
Time: July 6
Loss Amount: Approximately $20 million
Event Details: The attacker spent approximately $4 million to purchase enough BONK tokens, exploiting the Solana Realms governance platform's mechanism where a proposal requires only a 1% voting rate to pass, submitted a malicious proposal, and got it passed. After the proposal passed on July 6, the attacker transferred about 4.426 billion BONK (approximately $20 million) from the BonkDAO treasury. No smart contract failed during the entire process; the vulnerability was not in the contract code but in the governance rule design itself. Immunefi pointed out that this is a typical pattern for the most severe loss incidents in 2026 – funds are not lost from contract flaws but from governance votes and rule designs.
• Bonzo Lend Oracle Manipulation Attack
Time: July 11
Loss Amount: Approximately $9.05 million
Event Details: Bonzo Lend, the largest lending protocol on Hedera, suffered an oracle manipulation attack. The attacker exploited a signature verification vulnerability in the third-party oracle provider Supra to inject manipulated SAUCE token prices into the protocol. By artificially inflating collateral value, the attacker borrowed assets far exceeding the collateral value before the oracle corrected, causing approximately $9.05 million in losses. The protocol has suspended all activities, and Bonzo Labs and the Bonzo Finance foundation are coordinating recovery and remediation efforts.
• Verus-Ethereum Cross-Chain Bridge Secondary Attack
Time: July 23
Loss Amount: Approximately $7.55 million
Event Details: The Verus-Ethereum cross-chain bridge was attacked again, resulting in losses of approximately $7.55 million. This attack used the same contract path and vulnerability category as the May attack, highlighting how unpatched defects and re-deposited funds can make the system vulnerable to secondary attacks. This vulnerability is of the cross-chain bridge verification bypass type, where the attacker completed the fund theft through the same entry path.
• B2 Network Staking Contract Upgrade Authority Attack
Time: July 23
Loss Amount: Approximately $3.86 million
Event Details: The upgrade authority for the staking contract of B2 Network on BNB Chain was seized by an attacker, resulting in the loss of approximately 8.591 million B2 tokens (about $3.86 million). The attacker exchanged them for 5,409 WBNB (about $3.11 million) and bridged to Ethereum, currently transferring funds to Zcash via NEAR Intents. This event highlights that compromised keys and authorities – not the encryption technology itself – remain the main cause of major cryptocurrency thefts. The team has suspended staking functions and contacted the attacker on-chain, stating that if at least 10% of the stolen funds are returned within 24 hours, legal proceedings will not be initiated.
• Summer.fi Vault Configuration Vulnerability Attack
Time: July 6
Loss Amount: Approximately $6.04 million
Event Details: The FleetCommander vault of the Ethereum DeFi yield protocol Summer.fi was attacked. The root cause of the vulnerability was that when calculating totalAssets(), strategy components that had been set with deposit caps, were preparing to be decommissioned but had not yet been removed from the active set, were still included in the calculation. The attacker exploited this calculation deviation to accumulate assets and extract excess yield. Summer.fi, formerly Oasis.app, launched for MakerDAO users in 2019 and shifted to an AI-driven automated yield optimization layer in early 2026.
Rug Pull / Phishing Scams
Typical security events: 4
(1) On July 9, a victim with address starting 0x8c94 signed a phishing token approval on Ethereum, losing USDT worth $999,999.
(2) On July 24, a victim with address starting 0x3e1b lost $340,463 due to a phishing multicall on Ethereum.
Timeline:
06:51:47 UTC — The victim signed multicall() on the alphaUSDCDeltaV2 token contract. It contained: an approve() with unlimited allowance.
06:52:23 UTC — 36 seconds later, 332,787 alphaUSDCDeltaV2 (~$340K) was drained via transferFrom.
(3) Fake SecondFi Mobile App Phishing Attack
Loss Amount: Approximately $14.2 million
Nature of Event: On July 12, global crypto security monitoring platforms disclosed three high-risk crypto asset attack incidents. The first type was a fake SecondFi mobile app phishing attack targeting developers. The three attacks concentrated within 24 hours, targeting developers, ordinary retail investors, and high-net-worth whales, exposing security weaknesses across the entire Web3 ecosystem.
(4) Ledger Physical Letter Phishing Scam
Loss Amount: Approximately $960,000
Nature of Event: From July 3 to 7 (concentrated outbreak), a scam group mailed forged official Ledger physical letters to users' addresses. The letters featured the official logo, CTO signature, and post-quantum cryptography security update instructions, inducing users to scan a QR code to enter a highly imitated phishing website and enter their seed phrase, thereby stealing wallet assets. The Queensland Police confirmed that just during the period from July 3 to 7, the total losses reported by victims had exceeded 1.47 million AUD. Police reminded that Ledger officials will never request seed phrases via letters or phone calls.
Summary
The core characteristics of blockchain security incidents in July 2026 can be summarized with three keywords: Shift in Attack Vectors, Persistent Cross-Chain Bridge Failures, Prominent Governance-Level Vulnerabilities.
A clear shift in attack vectors is occurring: Non-code level attack methods such as off-chain infrastructure intrusion, signature key leaks, and governance vote manipulation are rising sharply. In the AFX Trade incident, the attacker completed a $24.15 million withdrawal merely by obtaining the signing key; the Ostium incident exposed the lack of protection mechanisms for off-chain authority management comparable to on-chain multi-signature standards; the BonkDAO incident shows that governance voting mechanisms themselves can become attack entry points.
Regarding phishing scams, several attacks this month exhibited a new pattern of "high-profile account compromise + fake token promotion," where brand trust is directly converted into a scam tool, and approval phishing has evolved from a one-time scam into a replicable, automated fund-draining process.
Zero Hour Technology Security Team Recommendations:
• For Individuals: Be wary of sudden "official" token promotions on platform X; do not click on unknown links or signing requests; regularly revoke wallet authorizations; use separate wallets to isolate risks for high-value assets.
• For Project Teams: Off-chain infrastructure authority management should meet the same security standards as on-chain multi-signature; use multi-signature + hardware signing for validator keys; set higher voting thresholds and timelocks for governance proposals; establish 7x24 monitoring and circuit breaker mechanisms; audits should cover the entire chain including key storage, authorities, and governance rules.
• For the Industry: Establish industry standards for cross-chain bridge key management; promote standardization of off-chain infrastructure security audits; strengthen APT threat intelligence sharing and blacklist database construction; recommend that project teams deploy bug bounty programs.
