Crypto projects lost roughly $110 million to hacks in July as Immunefi recorded more confirmed bug bounty reports and found that audit competitions uncovered more serious vulnerabilities than private audits.
Summary
- Crypto hacks caused approximately $110 million in losses during July.
- Immunefi paid researchers $2.32 million for confirmed vulnerabilities during the month.
- Audit competitions found 6.2 serious bugs per engagement, compared with 1.5 in private audits.
- Immunefi projects 114 major hacks in 2026, potentially surpassing the previous annual record.
Crypto hacks put 2026 on course for a record
Immunefi recorded 164 crypto hacks through Aug. 3, including 67 incidents that each caused more than $1 million in losses, according to data published by the security platform.
The company projects that the number of hacks exceeding $1 million could reach 114 by the end of 2026. That would surpass the previous annual record of 72 major incidents set in 2024. Only 49 such incidents had been recorded by the same point that year.
July’s estimated $110 million total added to an already costly year for the industry. A recent Blockaid report found that crypto security losses reached $1.1 billion during the first six months of 2026.
Several large attacks contributed to the July total. Ostium lost 23.75 million USDC after an attacker compromised its off-chain infrastructure and manipulated price data used by the protocol.
AFX suffered a separate $24.15 million bridge exploit during the month. Together, the two incidents accounted for more than $47 million in losses.
Bug bounty reports and payouts increased
Immunefi said its researchers received $2.32 million for confirmed vulnerabilities in July. The number of reports that were both confirmed and paid rose 18% from the previous month.
Its bug bounty programs prevented 374 threats, up from 317 in June and 339 in May. Cumulative payments to security researchers reached $143.1 million, compared with $140.8 million at the end of June.
The rise comes as artificial intelligence tools make it easier for researchers to scan code and prepare vulnerability reports. crypto.news previously reported that AI had driven a sharp increase in bug bounty submissions, although project teams also faced more low-quality reports and false positives.
Institutional interest in preventive security has also grown. Anchorage Digital invested in Immunefi earlier this year as part of a strategic push into on-chain security infrastructure.
Audit competitions found more serious flaws
Immunefi reviewed 1,178 audits conducted by tier-1 security firms and found a median of zero critical or high-severity vulnerabilities. However, the company’s comparison with 58 competitive audits produced a different result.
Audit competitions identified an average of 6.2 serious vulnerabilities per engagement, compared with 1.5 in private tier-1 audits, Immunefi said. Competitive reviews involve multiple independent researchers examining the same code and receiving rewards based on the vulnerabilities they find.
The average cost of identifying a critical flaw through an audit competition was $6,548. It compared with about $66,000 through a private tier-1 audit and an estimated $24.5 million when an attacker discovered the vulnerability first.
Recent incidents have shown that completed security reviews do not guarantee that code is free from exploitable flaws. A crypto.news investigation into the Coldcard breach found that an AI-assisted audit identified another 85 critical bugs across Bitcoin-related projects after a firmware weakness exposed wallet users.
Immunefi’s findings suggest that projects may need continuous bug bounty programs and competitive reviews alongside conventional audits. With 2026 already approaching the record for major incidents, the cost gap between preventive research and live exploitation remains substantial.
