The week of July 5 to July 11 turned into one of the roughest stretches of the year for crypto security, with three major protocol incidents, a wallet-level vulnerability and a string of smaller phishing and routing losses pushing confirmed damage past $35 million.
According to DefiLlama, the month’s tracked hacks had already produced combined losses exceeding $28 million before the Bonzo Lend hack added roughly $9 million more on Saturday.
The biggest loss of the week hit BonkDAO, the community governance body behind Solana’s BONK memecoin, with a $20 million treasury drain on July 6. The attacker did not break a single line of code. They quietly accumulated roughly $4 million worth of BONK through exchange wallets over several days, gained a dominant share of voting power, and pushed a malicious proposal, labeled “BIP #76 Sowellian BonkDAO,” through the DAO’s token-weighted governance on Solana’s Realms platform.
The proposal claimed it would implement new governance, install a new council, and monetize holdings, and had reportedly been live for six days without any challenge.
When the vote closed, wallets linked to the attacker controlled about 99.878% of the votes cast, with only seven addresses voting out of more than 18,000 eligible wallets. Roughly 4.426 trillion BONK, worth an estimated $20 million, moved from the treasury to attacker-controlled wallets, and the attacker even renamed the DAO.
BonkDAO confirmed the incident in an official statement on X dated July 6, saying it was the target of a malicious governance proposal, that it had identified the exchange wallets used to purchase BONK ahead of the vote, and that law enforcement had been notified.
SlowMist co-founder Yu Xian broke down the token movement in an X post, noting the incident was less a hack than a takeover through weak governance rules and low voter turnout. Arkham Intelligence tracking showed portions of the stolen BONK heading toward exchanges, and BONK fell more than 8%, deepening a decline of over 80% across the past year.
Latest update: As of the end of the week, BonkDAO has not confirmed that any portion of the stolen tokens has been frozen or recovered, and no compensation plan has been announced. Upbit, Bithumb, and Kraken have all suspended BONK deposits and withdrawals while monitoring inflows linked to the exploit.
The DAO says it is continuing to work with exchanges, bridges, the Solana Foundation and law enforcement, with further updates promised once forensic analysis is complete. Community pressure is mounting for reforms such as execution timelocks, higher quorums, and emergency multisig controls.
Hours before the BonkDAO news broke, multichain protocol Summer Finance was hit by a suspected flash loan exploit worth nearly $6 million. CertiK first flagged a suspicious transaction in which the attacker profited around $6 million using a roughly $65.4 million flash loan for liquidity manipulation, posting the alert from its CertiK Alert account on July 6.
PeckShield confirmed the protocol had been exploited for $6 million in DAI, and security firm Blockaid reported the funds were drained before any warnings reached users. Summer.fi responded by pausing all Lazy Summer vaults and cutting deposit caps to zero across networks.
On-chain intelligence indicated the largest single victim was a wallet linked to Torben Jorgensen, co-founder of Web3 firm UDHC, who had deposited about 8.6 million USDC into the affected pool shortly before the attack. The stolen DAI was swiftly converted through Uniswap V3 pools.
Latest update: The confirmed post-mortem shows the exploit traces back to November’s Stream Finance collapse, with the attack powered by stale tokens left over from that earlier failure rather than a fresh flaw in Summer.fi’s own vault logic. Vaults remain paused with deposit caps at zero while the team completes its review, and no reimbursement plan has been announced yet.
The week closed with Hedera’s biggest DeFi lender, Bonzo Lend, being hacked for $9 million, with $5.25 million bridged to Ethereum, on July 11. On-chain investigator Specter first flagged what appeared to be an ongoing hack involving the Hedera network in a July 11 post on X, reporting over $3.7 million already bridged to Ethereum via LayerZero and being swapped from WBTC into ETH, and publishing two theft addresses: 0x9A4..6a494 and 0xaf2…6dD93e.
PeckShield amplified the alert shortly after in its own X post, putting the bridged total at $5.25 million and noting the attacker’s wallet had been seeded with just 1 ETH from Tornado Cash, holding 2,360 ETH and 15.58 WBTC at the time.
Bonzo Finance confirmed the target in its official incident report posted on X and attributed the incident to a flaw in a third-party oracle’s verification process. The exploit began around 00:51 UTC on July 11, when the attacker submitted a manipulated price for the SAUCE token that inflated its value by about 12 orders of magnitude.
The oracle verifier accepted the update despite it carrying a zeroed signature rather than a valid one from the authorized committee.
Eight seconds later, the attacker used a deposit of just 250 SAUCE, worth a few dollars, as collateral to borrow approximately $9.05 million. The legitimate oracle feed restored SAUCE to about 0.1964 HBAR at 01:36 UTC, and Bonzo Lend was paused five minutes later.
Latest update: Bonzo identified Supra as the oracle provider whose verification infrastructure accepted the invalid update, and Supra has acknowledged the issue and deployed a fix to the affected verifier contract on Hedera mainnet.
A second wallet that borrowed roughly $1 million during the mispricing window has identified itself as a white hat and pledged to return the assets, bringing total abnormal borrowing to about $10.06 million. Bonzo Lend and Bonzo Points remain paused while the team evaluates recovery and withdrawal plans, while Bonzo Vaults, Bonzo Bridge, and single-sided staking continue operating normally.
The stolen funds remain parked in the attacker’s Ethereum wallets, which every on-chain sleuth is now watching, and the exploiter has not been identified. HBAR slipped to around $0.069, and Upbit, Bithumb, and Coinone issued investor caution notices.
Wallet users took direct hits too. Security firm Coinspect disclosed a vulnerability it calls Ill Bloom, rooted in how some older mobile and browser extension wallets generated recovery phrases with weak randomness, letting attackers derive the seed and drain everything it controls.
The firm confirmed a coordinated sweep on May 27 that drained about $3.1 million from 431 wallets, plus a further $2.1 million in USDT stolen afterward from a seed the same attacker had already compromised.
Latest update: As of Coinspect’s July 10 update, confirmed losses have passed $5 million, and the firm calls that a floor rather than a ceiling, as it keeps finding more vulnerable seed phrases along other generation paths. Its public checker has been expanded to reflect the larger exposed set.
The May attacker skipped wallets holding under about $5, but those seeds remain compromised, and anything deposited later can still be taken. Coinspect warned users never to enter a seed phrase into any checker or website, and to move funds to a hardware wallet with a freshly generated phrase if exposed.
Latest update: no recovery reported; Scam Sniffer data shows signature phishing losses up over 200% in early 2026 even as victim counts fall.
Latest update: no recovery reported; GoPlus Security attributed the loss to transaction routing rather than phishing and urged users to review execution paths before confirming large swaps.
Latest update: users have until August 3 to withdraw assets before the service goes offline.
Latest update: the proposal remains under community vote.
Latest update: the claims remain allegations based on on-chain activity, with no team response at the time of writing.
The week fits squarely into the pattern laid out in CertiK’s H1 2026 report published Monday: Web3 lost more than $1.31 billion across 344 incidents in the first half of 2026, with wallet compromises overtaking smart contract exploits as the biggest source of losses at $444.5 million, followed by phishing at $366.3 million across just 63 incidents.
CertiK’s blunt assessment was that the underlying security environment has not improved and has, in several respects, deteriorated. Immunefi separately counted a record 207 incidents in H1, and SlowMist logged 182 events worth about $956 million, with North Korean-linked groups blamed for roughly two-thirds of the stolen value.
What connects this week’s three big exploits is that none involved a simple contract bug in the traditional sense. BonkDAO was a governance takeover executed through the front door. Summer.fi was an automated vault machinery poisoned by tokens from a dead protocol. Bonzo Lend was a third-party oracle waving through a forged price.
The attack surface keeps climbing up the stack, away from the code that gets audited and toward the rules, infrastructure, and human approvals that mostly do not.
Also Read: Meme Coin Frenzy on Robinhood Chain: Trader Turns $838 Into a Million on CASHCAT
Key Highlights CYBERLEEK crashed after its contract owner reportedly cashed out more than $250,000. The…
Key Highlights The tokenized real-world assets market reached $44.7 billion as of August 26, 2026,…
Key Highlights Chainalysis estimates at least $457 billion in potentially taxable on-chain crypto activity occurred…
Key Highlights Nigeria’s Federal High Court in Abuja granted Usie Otukpa Osang ₦500 million bail…
Key Highlights Saitama CEO Manpreet Kohli lost his latest UK challenge against extradition to the…
Key Highlights Coinbase CPO Faryar Shirzad pushed back against the American Bankers Association’s concerns over…
This website uses cookies.
Read More