Keys, randomness, and compromise drove July’s biggest crypto losses

At a glance

What this is: This monthly security beat shows that July’s biggest crypto losses came from key and randomness failures, not clever contract logic.

Why it matters: It matters to IAM and NHI practitioners because compromised keys, signing paths, and third-party access all behave like identity failures once secrets become the control plane.

By the numbers:

• Crypto lost more than $240 million across 29 incidents in July 2026, up roughly 216% from June's $75.87M.

👉 Read Quantstamp’s July Security Beat on keys, randomness, and crypto losses

Context

July’s pattern is straightforward: when the key fails, the system fails. In crypto environments, signing keys, randomness sources, and custody workflows function as identity controls, because they decide who or what can authorize value movement. That makes this month relevant to NHI governance as much as to blockchain security.

The article also shows a broader governance problem. The same failure class appeared in both on-chain and off-chain incidents, from wallet firmware to bridge signing keys and compromised employee email accounts. That is a familiar NHI lesson: if a secret or token can be reused, replayed, or generated weakly, it becomes an access path rather than a control.

The starting position described here is typical of immature identity governance in high-value systems, where control owners focus on application logic while attackers target the trust material underneath it.

Key questions

Q: What breaks when key generation falls back to predictable inputs?

A: The trust boundary breaks immediately because the resulting keys are no longer exclusive or unguessable. Attackers can reproduce candidate seeds, test them against public or observable data, and recover access without exploiting the application itself. In high-value systems, entropy failure turns a cryptographic control into a recoverable identity event.

Q: Why do bridge and wallet keys need privileged identity governance?

A: Because they authorize value movement, not just system access. If those keys are stolen, reused, or generated badly, the attacker inherits the same trust the platform grants legitimate operators. Treating them as privileged identities forces lifecycle control, ownership, and revocation discipline instead of informal key handling.

Q: How do organisations know if their key management is working?

A: Key management is working when private keys are protected, certificates renew cleanly, revocation is enforced quickly, and trust failures are visible in monitoring. A healthy programme can answer who owns each key, where it is used, and what happens when it must be withdrawn.

Q: Who is accountable when a signing key is misused?

A: Accountability should sit with the business owner of the signing workflow, the identity or platform team that governs key custody, and the security function that defines control requirements. If signatures create legal or financial authority, the control framework should document ownership, approval policy, and evidence retention.

Technical breakdown

Why weak entropy turns key generation into a recoverable identity problem

Cryptographic key generation depends on sufficient entropy, meaning unpredictability in the random inputs used to create seeds and keys. When firmware falls back from a hardware random-number generator to predictable values such as serial numbers or clock registers, the search space collapses and attackers can brute-force the result. In practice, the problem is not just bad code. It is broken trust in the system’s identity root, because the key no longer proves exclusivity. This is why key generation quality must be treated as a security control, not a product detail.

Practical implication: validate entropy sources and fail closed when hardware randomness is unavailable.

Bridge and oracle keys as non-human identities

Bridge signing keys, oracle keys, and hot-wallet credentials are non-human identities because they authenticate software actions rather than people. They often have high privilege, broad reach, and limited human visibility, which makes them especially attractive to attackers. Once compromised, the attacker does not need to defeat application logic directly. They can simply authorize transfers or inject trusted data through the identity path that the system already accepts. This is the same governance problem seen in service accounts and API tokens: durable trust material becomes the attack surface.

Practical implication: inventory these keys as privileged identities and bind them to tight lifecycle controls.

Why governance proposals can become an execution channel

On-chain governance is not just a decision layer. In many protocols it is also an execution layer, where approved proposals can directly move treasury assets or alter control parameters. If proposal validation, signer verification, or quorum protections are weak, governance becomes a privileged access path. The security issue is therefore not limited to voting fraud. It is an identity and authorization failure, because the system trusts a governance event as if it were a legitimate privileged operator. That makes governance hardening a core control objective.

Practical implication: separate proposal approval from execution authority and require stronger checks on treasury-changing actions.

Threat narrative

Attacker objective: The attacker objective was to obtain trusted signing authority and convert it into immediate theft of funds or control over treasury actions.

1. Entry occurred through weak key generation or compromised signing material, which allowed the attacker to derive or seize trusted credentials.
2. Escalation followed when those credentials were used to authorize wallet drains, bridge withdrawals, or fraudulent governance execution.
3. Impact was direct asset loss, with July’s incidents including a roughly $115 million hardware-wallet drain and additional key-compromise thefts.

NHI Mgmt Group analysis

Key security failures increasingly look like identity failures: July’s losses show that the decisive control is not only contract correctness but the integrity of the keys, signers, and execution paths underneath the contract. Once a system trusts a credential, a seed, or a governance signer, attacker success depends less on code complexity and more on the quality of identity governance. For practitioners, that means treating signing material as privileged identity infrastructure, not as a supporting asset.

Entropy collapse is a governance issue, not just a cryptography issue: The Coldcard case shows how fallback logic can silently degrade the entire trust model when hardware randomness is unavailable. That is a named failure mode worth tracking across crypto custody, hardware appliances, and any system that generates long-lived secrets. Security teams should review whether failure states preserve unpredictability or quietly substitute guessable inputs; if they do the latter, the control has already failed.

Non-human identity oversight must extend to wallets, bridges, and oracle operators: These systems use keys that behave like machine identities, often with standing privilege and limited lifecycle governance. The same control gap appears in enterprise environments when service accounts outlive their purpose or when credentials are not bound to context. The practitioner conclusion is clear: if a key can move value, it needs the same governance discipline as any other high-risk identity.

On-chain governance can become a privileged access channel: A governance proposal that can execute treasury changes is an authorization mechanism, not just a voting mechanism. If the execution path is weakly separated from proposal approval, malicious or coerced governance can bypass normal operator controls. For risk owners, the lesson is to map governance actions to privileged identity boundaries and to challenge any model that treats community vote logic as sufficient assurance.

July’s month-over-month spike confirms that key-centric attacks are scaling across domains: The same pattern appeared in crypto custody, bridge operations, and even off-chain compromise scenarios. That makes key management the common governance layer, whether the asset is a token, a wallet, or a backend account. Practitioners should assume attackers will keep following the trust material, because that path is usually shorter than breaking the application itself.

What this signals

The signal for practitioners is that crypto-style key compromise behaves like a high-speed NHI incident: the attacker does not need a user session if the secret itself is the session. That makes inventory quality, ownership, and rotation discipline the controls that determine blast radius. For lifecycle guidance, align wallets and signers with the same lifecycle expectations used for other privileged machine identities.

Key custody debt: This article is a reminder that organisations accumulate risk whenever key generation, fallback logic, and execution authority are separated from governance oversight. Once that debt builds, compromise becomes a matter of time rather than sophistication.

Teams that already monitor service accounts and API tokens should extend the same detection logic to bridge signers, oracle operators, and wallet infrastructure. The strongest programmes will connect secret custody to NHI lifecycle controls, because the attack path is fundamentally the same.

For practitioners

• Verify entropy failover paths in key generation systems Test what happens when the hardware random-number generator is unavailable and confirm the system stops rather than substituting predictable inputs such as serial numbers or clocks.
• Classify signing keys as privileged non-human identities Record bridge signers, oracle keys, wallet keys, and automation keys in the same inventory discipline used for high-risk service accounts and other privileged identities.
• Separate governance approval from execution authority Require distinct controls for proposal submission, quorum validation, and treasury execution so a single compromised governance path cannot directly move assets.
• Monitor for key-compromise patterns across third parties Review supplier platforms, employee email compromise routes, and custody workflows together because attackers often pivot from one trust domain into another.

Key takeaways

• The month’s largest losses came from compromised keys and weak entropy, which means the control failure sat in identity trust material rather than protocol logic alone.
• The Coldcard event, bridge compromise, and governance abuse cases all show the same pattern: once signing authority is lost, attackers can move value without further technical complexity.
• Practitioners should govern wallets, bridges, and oracle keys as privileged non-human identities and validate that entropy, execution, and lifecycle controls fail closed.

Key terms

• Entropy collapse: Entropy collapse is a training condition where a policy becomes too concentrated on a small number of preferred output paths. In RLVR, this can improve benchmark scores while reducing generalisation, because the model loses behavioural diversity and becomes less robust to new prompts or shifted data.
• Signing Key: A signing key is a secret used to create or verify trusted authentication material. When that key is tied to identity infrastructure, it can become a high-value trust anchor that affects many systems at once. If it is reused or left unrotated, compromise can spread far beyond the original service.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Governance Execution Path: A governance execution path is the sequence that turns a decision, proposal, or approval into a real system action. If that path is weakly separated from approval controls, attackers can abuse legitimate governance mechanics to move assets or change critical configuration.

What's in the full article

Quantstamp's full article covers the incident-level detail this post intentionally leaves for the source:

• Per-incident loss breakdown across July’s crypto failures, including the biggest on-chain categories and the month’s total impact.
• Source-by-source references for the Coldcard, bridge, oracle, and governance cases used in the monthly analysis.
• Additional context on the off-chain incidents that showed the same compromise pattern as the crypto losses.
• The article’s original incident notes and commentary on how July compares with prior months.

👉 Quantstamp’s full post covers the incident list, loss breakdown, and source references behind July’s security beat.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle controls. It helps security practitioners translate identity discipline into practical control ownership across high-risk systems.