The numbers continue to swell with no signs of slowing down. Throughout July 2026, various crypto projects once again lost a total of $110 million due to security vulnerabilities.
The latest data from Immunefi up to August 3, 2026, recorded 164 hacks year-to-date. Of those, 67 incidents recorded losses of over $1 million. Immunefi projects that these large-scale incidents could hit 114 by the end of the year, surpassing the record of 72 incidents registered in 2024.
July’s losses were driven by two main events. Ostium lost 23.75 million USDC when attackers managed to breach their off-chain infrastructure and manipulate price data. Meanwhile, AFX was hit by a $24.15 million bridge exploit. These two incidents drained more than $47 million from the market.
A separate report from Blockaid highlighted a broader picture: security losses in the crypto industry surpassed $1.1 billion in the first six months of 2026.
Million-Dollar Bounties and a New AI Problem
While hackers remain active, bug hunters are not standing idly by. Security researchers on the Immunefi network received $2.32 million in payouts for various vulnerabilities they confirmed in July. The number of confirmed and paid reports rose 18% from June. This bug bounty program prevented at least 374 threats during July, up from 317 threats in the previous month.
To date, the cumulative total payout to security researchers has reached $143.1 million. This support has also attracted institutional players, with Anchorage Digital reportedly investing in Immunefi as part of their on-chain security strategy.
However, this defensive landscape faces a new technical hurdle: artificial intelligence. While AI tools indeed make it easier for researchers to scan code and compile reports faster, this convenience has unfortunately flooded the platform with more low-quality reports that take time to verify.
Why Standard Audits Frequently Fail
The high volume of hacks raises questions about the vetting process before smart contracts are released. Immunefi’s data reveals an effectiveness gap between existing audit methods.
Competitive audits turned out to find an average of 6.2 serious vulnerabilities in each audited project. By comparison, closed first-tier audits only found an average of 1.5 serious vulnerabilities. This pattern suggests that many fatal bugs are missed when the code is only reviewed by a single small team.
The Web3 defense system is indeed far from perfect, but these vulnerability findings at least map out where weak points commonly reside.
Reported from crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
