Notifications
Clear all
Topic starter
18/08/2026 2:14 pm
TL;DR: July 2026 crypto losses exceeded $240 million across 29 incidents, with private key, entropy, and hot-wallet compromise accounting for about $149.3 million and a firmware flaw in Coldcard hardware wallets contributing roughly $115 million, according to Quantstamp. The month reinforces that key custody and randomness quality are now operational risk controls, not implementation details.
NHIMG editorial — based on content published by Quantstamp: July Security Beat: Keys Over Code (Again?)
By the numbers:
- Crypto lost more than $240 million across 29 incidents in July 2026, up roughly 216% from June's $75.87M.
Questions worth separating out
Q: What breaks when key generation falls back to predictable inputs?
A: The trust boundary breaks immediately because the resulting keys are no longer exclusive or unguessable.
Q: Why do bridge and wallet keys need privileged identity governance?
A: Because they authorize value movement, not just system access.
Q: How do organisations know if their key management is working?
A: Key management is working when private keys are protected, certificates renew cleanly, revocation is enforced quickly, and trust failures are visible in monitoring.
Practitioner guidance
- Verify entropy failover paths in key generation systems Test what happens when the hardware random-number generator is unavailable and confirm the system stops rather than substituting predictable inputs such as serial numbers or clocks.
- Classify signing keys as privileged non-human identities Record bridge signers, oracle keys, wallet keys, and automation keys in the same inventory discipline used for high-risk service accounts and other privileged identities.
- Separate governance approval from execution authority Require distinct controls for proposal submission, quorum validation, and treasury execution so a single compromised governance path cannot directly move assets.
What's in the full article
Quantstamp's full article covers the incident-level detail this post intentionally leaves for the source:
- Per-incident loss breakdown across July’s crypto failures, including the biggest on-chain categories and the month’s total impact.
- Source-by-source references for the Coldcard, bridge, oracle, and governance cases used in the monthly analysis.
- Additional context on the off-chain incidents that showed the same compromise pattern as the crypto losses.
- The article’s original incident notes and commentary on how July compares with prior months.
👉 Read Quantstamp’s July Security Beat on keys, randomness, and crypto losses →
Keys and randomness failures: what security teams need to act on?
Explore further
18/08/2026 3:06 pm
Key security failures increasingly look like identity failures: July’s losses show that the decisive control is not only contract correctness but the integrity of the keys, signers, and execution paths underneath the contract. Once a system trusts a credential, a seed, or a governance signer, attacker success depends less on code complexity and more on the quality of identity governance. For practitioners, that means treating signing material as privileged identity infrastructure, not as a supporting asset.
A question worth separating out:
Q: Who is accountable when a signing key is misused?
A: Accountability should sit with the business owner of the signing workflow, the identity or platform team that governs key custody, and the security function that defines control requirements. If signatures create legal or financial authority, the control framework should document ownership, approval policy, and evidence retention.
👉 Read our full editorial: Keys, randomness, and compromise drove July’s biggest crypto losses
