GoPlus July 2026 Web3 & AI Security Data Report

In July 2026, the scale of losses from Web3 security incidents surged dramatically: a total of 43 major security incidents were recorded throughout the month, with cumulative losses of approximately $319 million, which is 4.1 times that of June and one of the largest loss months of the year. Structurally, losses were highly concentrated in exploit-type attacks, with 37 incidents totaling approximately $310,776,183. The largest single loss in a month reached $88.6 million (due to a Coldcard wallet password algorithm issue), with the top five incidents accounting for approximately $234 million, or about 73.5% of total losses.

Compared to June, there was a significant shift in the focus of risks in July: the top three loss categories were governance attacks (approximately $97.6 million), cryptographic algorithm flaws (approximately $88.6 million), and private key/key leaks (approximately $82.5 million), together accounting for about 84% of total losses. The weaponization of governance proposals, flaws in the underlying cryptographic implementations of hardware wallets, and the loss of control over keys in cross-chain bridges and hot wallets formed the three most destructive lines of attack this month.

In terms of AI security, a notable change in July was the shift in risk discussions from "prompt injection" and "content pollution" to execution, data, and trust aspects. The first publicly disclosed "agentic attacker" intrusion incident by Hugging Face, the erroneous deletion of user home directories by GPT-5.6 Sol, the entire library upload of Git history by Grok Build CLI, and Claude's shared links being indexed by search engines collectively indicate that the boundaries of AI systems are no longer just dialogue windows, but encompass the entire runtime environment and data assets.

I. Overview of Web3 Security

1. Overall Data (July 2026)

• Number of incidents: 43
• Cumulative losses: $318,918,645 (approximately $319 million)
• Exploit: 37 incidents, approximately $310,776,183
• Rugpull (large amounts): 2 incidents, approximately $6,593,000
• Phishing (large amounts): 4 incidents, approximately $1,549,462
• Largest single loss: $88.6 million (Coldcard wallet)
• Total of top five incidents: approximately $234.35 million, accounting for about 73.5% of total losses
• Incidents with losses exceeding $1 million: 17

From the monthly distribution, July exhibited the characteristic of "stable number of incidents, extreme single losses": the total number of incidents was roughly the same as in June, but total losses increased more than fourfold. This month, 8 incidents had single losses exceeding $9 million, with 2 incidents exceeding $75 million, indicating that attackers are concentrating their firepower on governance treasuries, underlying cryptographic implementations, and high-value key targets, while also conducting widespread attacks on smaller projects.

2. Major Types of Attacks

The major types of attacks in July (grouped by losses) are as follows:

If categorized by attack surface, the following five structural directions are noteworthy in July:

• Governance and Proposal Surface: Two proposal attacks resulted in total losses of approximately $97.6 million, with governance mechanisms upgraded from "configuring risks" to "direct channels for fund theft", becoming the largest source of losses this month.
• Cryptographic Implementation Surface: The Coldcard hardware wallet suffered losses of approximately $88.6 million due to cryptographic algorithm issues, indicating that risks have penetrated to the underlying implementation levels such as signature schemes, random numbers, and key derivation, rather than remaining at the contract and protocol logic levels.
• Key and Permission Surface: There were 8 incidents of private key/key leaks, totaling approximately $82.5 million, with cross-chain bridge administrators, trading platform administrator accounts, hot wallet clusters, and early whale addresses all affected simultaneously, indicating that key management remains the number one killer with "low frequency, high lethality".
• Cross-Chain and Oracle Surface: The Wanchain bridge suffered losses of approximately $9 million due to signature semantic reuse, and bonzo finance lost approximately $9.05 million due to Oracle verification vulnerabilities, indicating that cross-chain verification links and price/data verification links remain high-risk areas.
• Contract Logic Surface: There were as many as 22 incidents of contract vulnerabilities, still the most frequent type, but with an average single loss of approximately $1 million, significantly lower than governance and key-related incidents, showing a "high frequency, low loss" pattern.

3. Typical Incidents

@COLDCARDwallet: Cryptographic Algorithm Issue, Loss of Approximately $88.6 Million

On July 31, the Coldcard hardware wallet was revealed to have vulnerabilities at the cryptographic algorithm level, leading to the theft of a large amount of user assets, with losses estimated at approximately $88.6 million, making it the largest single incident of the month. The uniqueness of this incident lies in the fact that the victim was not a specific DeFi protocol, but rather a hardware signing device widely regarded as "the most secure". When flaws occur in the underlying cryptographic implementations (signature, random number, key derivation), no matter how good the operational habits and permission governance are at the upper level, they cannot provide a safety net, ringing alarm bells for the entire industry's supply chain trust.

BarnBridge SMART Yield: Proposal Attack, Loss of Approximately $77.6 Million

On July 15, the BarnBridge SMART Yield protocol on Ethereum suffered a proposal attack, resulting in losses of approximately $77.6 million. The attacker directly controlled the disposal rights of the protocol's funds through malicious governance proposals. This once again proves that governance contracts themselves are one of the highest value attack targets, and any failure in proposal review, voting thresholds, time locks, or pre-execution simulations can lead to treasury-level losses.

@AFX_XYZ: Cross-Chain Bridge Private Key Leak, Loss of Approximately $24.15 Million

On July 23, AFX's cross-chain bridge on Arbitrum was attacked due to a private key leak, resulting in losses of approximately $24.15 million. Once the signature key of the cross-chain bridge is out of control, the attacker can forge legitimate cross-chain message instructions, bypassing all contract layer protections to directly withdraw bridge reserve assets.

@Ostium: Administrator Account Private Key Leak, Loss of Approximately $24 Million

In July, Ostium, an RWA trading platform on Arbitrum, was suspected to have been attacked due to a private key leak from the administrator account, resulting in losses of approximately $24 million. This incident occurred in the same week as AFX, indicating that targeted attacks on high-privilege accounts in the Arbitrum ecosystem may be forming a trend of scale.

BonkDAO: Malicious Governance Proposal, Loss of Approximately $20 Million

On July 7, BonkDAO became the target of a malicious governance proposal, with approximately $20 million worth of BONK tokens being transferred from the BonkDAO treasury. Combined with the BarnBridge incident, the two proposal attacks in July resulted in nearly $100 million in losses, with "governance attacks" evolving from theoretical risks to the most profitable attack method of the month.

Solana Early Whale: Suspected Private Key Leak, Loss of Approximately $14.2 Million

On July 10, an early whale address related to the distribution of the Solana genesis block was suspected to have leaked its private key, resulting in approximately 180.9K SOL (approximately $14.2 million) being stolen. The concentration of attention on early addresses that have been dormant for many years suggests that the storage media, backup methods, and historical exposure of old keys need to be reassessed.

TripleAHQ: Multi-Chain Hot Wallet Cleared, Loss of Approximately $9.7 Million

On July 25, the hot wallet of payment infrastructure project TripleA was simultaneously attacked across multiple chains including TRON, Ethereum, TON, and Solana, resulting in losses of approximately $9.7 million. The simultaneous breach of multi-chain hot wallet clusters indicates systemic flaws in key generation or custody, rather than a single operational error.

Wanchain: Cross-Chain Bridge Signature Semantic Reuse, Loss of Approximately $9 Million

On July 21, the Wanchain Cardano→BNB Chain cross-chain bridge was attacked on the Cardano side, with approximately 515.2 million NIGHT being withdrawn from the bridge reserves, valued at approximately $9 million. Following the incident, Wanchain bridge suspended services, and NIGHT once dropped nearly 50%. Issues related to signature semantic reuse indicate that the isolation of signature domains, message formats, and verification rules between heterogeneous chains remains one of the most underestimated attack surfaces in cross-chain systems.

bonzo_finance: Oracle Verification Vulnerability, Loss of Approximately $9.05 Million

On July 11, the lending protocol bonzo finance was attacked due to an Oracle verification vulnerability, resulting in losses of approximately $9.05 million. Defects in price and data verification can still cause losses of nearly ten million dollars within a single event, indicating that the verification of data sources for oracles, constraints on abnormal fluctuations, and governance of feeding permissions remain fundamental vulnerabilities for DeFi protocols.

4. Summary and Recommendations for Web3 Security This Month

4.1 Summary of This Month

• Summary 1: Governance attacks have escalated to the number one source of losses. Two proposal attacks resulted in nearly $100 million in losses, and the submission, voting, time locks, and execution chains of governance proposals must be regarded as core assets equally important as private keys.
• Summary 2: Risks have penetrated to the underlying cryptography and supply chain. The Coldcard incident indicates that the "trust foundations" such as hardware wallets, password libraries, and signature implementations can also become the largest single points of failure, and the audit scope must extend to the cryptographic implementation level.
• Summary 3: Loss of control over keys presents a "surface explosion". Cross-chain bridges, trading platforms, multi-chain hot wallets, and early whales all experienced incidents in the same month, indicating that attackers are systematically harvesting high-privilege key targets.
• Summary 4: Contract vulnerabilities are becoming high-frequency and low-loss. With 22 incidents of contract vulnerabilities, the average single loss is approximately $1 million, indicating that traditional contract vulnerabilities are becoming "normalized", while large losses increasingly stem from governance, keys, and underlying implementations.

4.2 Security Recommendations

• Implement mandatory simulations before executing governance proposals, emergency funding movement cutoffs, monitoring of voting power concentration, and tiered time locks, prohibiting any proposal from reaching the treasury without independent review.
• Establish cryptographic implementation-level audits and fuzz testing for hardware wallets, signature libraries, random numbers, and key derivation modules, with key devices supporting verifiable firmware and supply chain traceability.
• Execute key sharding, remote isolation, hardware custody, and regular rotation for cross-chain bridges, trading platform administrators, and multi-chain hot wallets, with high-privilege accounts defaulting to multi-signature + limits + delayed execution.
• Establish special audits and runtime monitoring for the signature domains, message formats, state synchronization, and abnormal outputs of cross-chain systems, focusing on preventing signature semantic reuse and verification defects between heterogeneous chains.
• Establish multi-source verification, deviation cutoffs, and permission tiering for oracle feeding, and conduct continuous audits on historical contracts and old version pools to avoid repeated harvesting of "old vulnerabilities".

II. AI Security Incidents and Trends

If June's keyword was "the full externalization of risk entry," July more clearly indicates that the main battlefield of AI security has shifted from "what content to inject" to "what an agent can execute, what it can take away, and where the trust boundaries lie." This month saw four representative incidents, each corresponding to significant upgrades in attack surface, execution, data, and trust.

Hugging Face Invasion Incident: The First Public Case of an 'Agentic Attacker'
In July, Hugging Face disclosed an invasion incident targeting its production infrastructure: the attack was entirely driven by an autonomous AI Agent system, and the defense's detection and forensics primarily relied on its own AI system, marking a significant event in the transition from industry warnings to real-world cases of "agentic attackers." Some internal datasets and several service credentials were accessed without authorization; the official statement indicated that no user-facing models, datasets, or Spaces were altered, and software supply chain verification remained secure.

Key stages of the attack chain included:

• Initial Access: Using a "malicious dataset" as the attack vector — the dataset itself was weaponized, making the data layer a primary attack surface.
• Execution: Simultaneously abusing two code execution paths — remote code execution via the dataset loader and template injection in the dataset configuration, using both paths increased the success rate of triggering.
• Privilege Escalation and Lateral Movement: Elevating from data processing workers to node-level access, collecting cloud platform and cluster credentials, and infiltrating multiple internal clusters over a weekend.
• Command and Control: The autonomous Agent framework operated across numerous short-lived sandboxes, with C2 possessing self-migration capabilities, rendering traditional IP/domain blacklist detection methods significantly ineffective.
• Scale and Pace: Thousands of independent operations, over 17,000 behavioral logs, with the attack pace reaching "machine speed," exceeding human response windows.

This incident also exposed a deep-seated contradiction — "asymmetry in AI guardrails": HF attempted to analyze attack logs (including real attack commands and payloads) using commercial cutting-edge model APIs during the forensics phase, but was intercepted by the security guardrails of the model provider, as the guardrails could not distinguish between "emergency response analysts" and "attackers." HF ultimately turned to an open-source weight model (GLM 5.2) deployed on its own infrastructure for analysis. This serves as a reminder to all security teams: prepare self-hosted analysis models in advance and incorporate them into the IR toolchain, rather than seeking available analysis paths after an incident occurs.

GPT-5.6 Sol Accidentally Deleted All Files: When Agents Transition from 'Doing Things' to 'Direct Execution'
In July, former HyperWrite CEO and AI investor Matt Shumer publicly disclosed that while testing OpenAI's GPT-5.6 Sol in Ultra mode, a local agent's review subagent mistakenly expanded $HOME during a cleanup task and executed the rm -rf command, deleting "almost all files" on his Mac.

The essence of this incident is not that "the model said something dangerous," but rather that an agent with file system permissions, terminal capabilities, and sub-agent orchestration abilities executed a path misjudgment as a real data disaster. It exposed at least four layers of issues: overly broad permission boundaries (the Full Access mode's lethal radius covered the entire home directory), task boundary drift ("cleaning files" was upgraded to recursive deletion), sub-agent amplification of errors (errors inherited and rationalized along the agent chain), and high-risk actions lacking mandatory human confirmation.

The engineering conclusion from this incident is very straightforward: policies must be established for intercepting and explicitly confirming high-risk actions such as recursive deletion, bulk overwriting, directory writes, credential reads, and external requests; sub-agent permissions must be less than those of the main agent; high-privilege tasks should run in isolated environments such as containers or snapshot workspaces; cloud synchronization does not equal backup, and recoverable versioned snapshots must be established.

Grok Build CLI Whole Library Upload: The 'Invisible Data Channel' of AI Programming Tools
In July, researcher cereblab's packet analysis pointed out that xAI's official Grok Build CLI (version 0.2.93) not only sends the contents of files read by the model to the cloud during operation but also uploads the entire repository in the form of a git bundle through a separate POST /v1/storage channel — including the complete Git history. Under the prompt "only reply OK, do not open any files," the CLI still uploaded the entire repository, and the researcher was able to recover a canary file that was explicitly prohibited from being read from the uploaded content. More seriously, turning off the "Improve the model" switch did not prevent this upload behavior. (xAI subsequently disabled this path via server response with disable_codebase_upload.)

The warning from this incident is that Git history often hides more sensitive assets than the current working directory — deleted keys, rolled-back debug code, implementation details, and traces of internal architecture. The security boundaries of AI programming tools cannot only focus on the current project directory; the entire repository, local configuration, and credential directories must be viewed as potential exposure surfaces. For enterprises, conducting real traffic audits on AI CLIs, running them in isolated environments, and including Git history in sensitive asset governance has shifted from "best practice" to "mandatory course."

Claude Share Links Indexed by Search Engines: Sharing Equals Publishing
Around July 25, numerous share links created by Claude users (claude.ai/share) were found to be indexable and retrievable by search engines like Google. It is important to clarify that this is not a backend intrusion: according to Anthropic's official documentation, the snapshot page generated when users click Share is visible to anyone holding the link. The real issue is that the user mentality of "forwarding a conversation to a colleague" semantically equates to "publishing a public web asset" in the system — it may be indexed, cached, archived, and forwarded again, and robots.txt does not constitute access control, nor is the cleanup process atomic.

In the Agent era, the radius of risk from this exposure is even larger: a publicly shared conversation may expose not only text but also internal systems accessible by the agent, commonly used tool calls, RAG fragments, approval scripts, and even path clues pointing to .env, .ssh, and .aws/credentials. For attackers, even if they cannot obtain valid keys, a "workflow map" itself is sufficient to support more credible phishing pages, more precise indirect prompt injections, and more targeted supply chain attacks.

Security Trends: Prompt Injection Continues to Be the Main Line of AI Attacks in 2026
Public industry statistics show that prompt injection has ranked first in the OWASP LLM application risk list for two consecutive years; in AI attacks observed in 2026, indirect prompt injection accounted for over 55%, with multi-hop indirect attacks increasing by over 70%, and about 62% of successful cases in enterprise environments followed the indirect injection path. This resonates with the four incidents in July: whether it is malicious datasets, repository history, share links, or external content, attackers are increasingly inclined to hide instructions within "trusted data" rather than directly confronting model guardrails.

Summary of AI Security Trends in July

• Judgment One: The offense and defense have entered the "Agent vs Agent" era. In the HF incident, the attack was driven by an autonomous agent, and forensics were completed by an AI system, requiring the defense to lay out AI analytical capabilities as infrastructure in advance due to the "machine speed" of the offense and defense.
• Judgment Two: Execution incidents are beginning to cause real asset losses. Accidental deletions, modifications, and authorizations are no longer theoretical risks; a single path misjudgment by a high-capability agent can lead to irreversible data disasters, making least privilege and human confirmation baseline requirements.
• Judgment Three: The data surface is fully weaponized. Datasets, repositories, Git history, share links, logs, tickets — any data that can be processed by the model may become an attack vector or leakage channel, with "data as attack surface" becoming a consensus.
• Judgment Four: Transparency and auditability have become core contradictions. The actual behavior of tools is inconsistent with the descriptions of settings, and the semantics of sharing are inconsistent with user mentality, indicating that relying solely on vendor goodwill and product documentation cannot establish trust; real traffic audits and independent verification have become necessary.
• Judgment Five: Defensive guardrails exhibit structural asymmetry. Security guardrails based on content features may inadvertently harm the defense in legitimate scenarios such as DFIR, and self-hosted analysis models and backup analysis paths that are "not interrupted by guardrails" should be included in emergency plans.

AI Security Recommendations

• Implement least privilege for agents: by default, only open single project workspaces, and do not grant full capabilities of the entire machine's file system, terminal, and network; sub-agent permissions must be less than those of the main agent.
• Establish policy-level interception and explicit human confirmation for high-risk actions such as recursive deletion, bulk overwriting, directory writes, credential reads, and external requests; approval information must include complete target paths and impact ranges.
• Run AI CLIs and coding agents in containers, dedicated VMs, or snapshot workspaces; conduct real traffic audits on core tools to verify which data has truly left the local machine.
• Include Git history, local configuration directories, CLI credentials, and third-party tokens in sensitive asset governance; credentials should be injected temporarily to avoid static storage.
• Establish governance for AI share links: default to private, share within the organization, expire after a set time, and be auditable and revocable; clarify user education that "sharing equals publishing" and do not treat robots.txt as access control.
• Deploy self-hosted analysis models in advance for incident response, ensuring that there are backup analysis paths in DFIR scenarios that are not interrupted by commercial model guardrails, and sensitive attack data does not leave the country.
• Implement sandboxing and path-level deep defense for "data processing as code execution" stages such as dataset loading, template rendering, and document parsing, and be vigilant against dual vulnerability chain exploitation.

III. Summary and Outlook

In July 2026, Web3 and AI once again exhibited a highly isomorphic trend: the greatest losses no longer stem from single-point vulnerabilities but from the erosion of trust foundations — on the Web3 side, it is governance mechanisms, key systems, and cryptographic implementations; on the AI side, it is execution permissions, data channels, and trust boundaries.

On the Web3 side, a loss of $319 million in a single month signals to the industry that the focus of auditing and risk control must expand from "contract logic" to governance chains, key supply chains, and underlying cryptographic implementations; on the AI side, the first public case of an agentic attack and multiple incidents on the execution and data surfaces signal to the industry that security construction must upgrade from "content filtering" to systematic governance of runtime environments, data assets, and trust boundaries.

For both types of systems, the upcoming focus of security construction should no longer remain on "discovering single-point vulnerabilities," but should shift to continuous auditing, least privilege, runtime guardrails, trust layering, and fully verifiable governance throughout the process.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.