$60 Million in Crypto Hacks: Detection Scales, Patching Doesn't

Between July 19 and 27, 2026, $60.45 million was stolen in eight hacks targeting crypto protocols and companies: 80% of what was stolen in the entire month of June ($75.87 million across 40 incidents, according to security firm PeckShield) concentrated in just nine days. The figure matters less than the pattern: almost none of these attacks required a new flaw. Verus fell through the same code path that had already been exploited in May, Allbridge due to a pool architecture (shared liquidity funds) that its own 2023 post-mortem promised to eliminate, and Triple-A continued accepting deposits that the attacker swept in real-time for 31 hours. Finding vulnerabilities is already scaling as software scales —with automated agents on both sides, backed by public and dated figures—. Fixing them still moves at committee speed: audit, vote, multi-sig, deployment. This article measures that gap with data from both sides and marks precisely where the provable ends.

Which protocols fell between July 19 and 27, 2026?

Eight incidents with quantified losses and one without (the X account of Robinhood's CEO, used to promote a memecoin). The on-chain analysis account Lookonchain grouped the peak of July 22-23 under the label "Hackers' Day" —two cross-chain bridges breached six hours apart, flagged by security firm Blockaid in real-time—. The detail matters more than the aggregate because the vector repeats: signature quorum, upgrade permissions, and hot wallets, with only one case of poorly designed pool mathematics.

Triple-A deserves a separate note because it is a regulated gateway in Singapore and not an anonymous protocol: client funds are held in fiduciary accounts required by the country's monetary authority and were not touched. What was drained was the company's own treasury. Even so, the attack lasted more than a full day and deposit accounts remained open while it occurred.

Why did Verus, Allbridge, and Triple-A fall to known flaws?

All three cases share the same form: knowledge of the flaw existed before the attack, and the remedy did not reach production in time. Placed in chronological order, the sequence is difficult to dismiss as bad luck.

1. Verus, two months and a relapse. In May 2026, the bridge lost approximately $11.5 million due to an import route that issued unbacked payments on the Ethereum side. The attacker returned 4,052.4 ETH, keeping a 25% bounty. The recovered funds were formally re-deposited into the bridge in early July. Fifteen days later, on July 23, a different attacker with a new wallet abused the same class of bug in the same contract and took $7.54 million: two months between the first detection and the second loss, with the contract left intact.
2. Allbridge, three years and three months. A flash loan attack in April 2023 cost them about $573,000. The public post-mortem promised a specific measure: a single liquidity pool per blockchain, precisely so that manipulation could not be completed in a single transaction. The deployment on Solana kept USDC and USDT in the same pool architecture, which is exactly the second token the exploit requires. The fix was written, published, and not applied where it was needed.
3. Triple-A, a 31-hour window. The on-chain researcher known as Specter detected and published the anomalous movements on Friday, July 24, when $9.3 million had already been drained. The company did not publicly confirm the breach until Monday, July 27. In the meantime, deposits were never deactivated: the attacker continued sweeping new entries until the total reached $11.8 million.

The pattern is the one we already documented in the 2026 hacks targeting the perimeter, not the contract: AFX, B², and Triple-A did not fall due to poorly audited financial mathematics, but because of keys, permissions, and operational processes. The novelty of July is the documented recidivism on the same code.

Why doesn't patching a DeFi protocol scale like auditing it?

A code analysis can be launched against a thousand repositories at once, without anyone's permission and at no cost if it fails; a production patch requires reproducing the flaw, auditing the fix, gathering multi-sig signatures, clearing a timelock (a mandatory delay before the change takes effect), and, if the contract is updated by vote, passing through governance. Every step of the second path has human latency measured in days or weeks.

The uncomfortable part of that chain is the multi-sig. In the analysis of multi-sig as security theater, the problem was that signatures do not protect without a real custody model. In July, the opposite side of the same mechanism appeared: the five validators of AFX Trade had their keys hot, and the quorum that exists to stop an improper withdrawal became the master key as soon as the attacker gathered the five signatures. A scheme that slows down legitimate correction without slowing down the attacker has inverted its function.

How many vulnerabilities does AI find today, and how many does it patch?

Both sides of the asymmetry between finding flaws and fixing them have published and dated figures, and when compared in the same table, the gap is an order of magnitude. None of these systems have been used —as far as is known— against a crypto protocol; they serve to measure the speed at which each half of the problem is advancing in general software.

A single agent submitted over a thousand reports in three months, with more than 400 already resolved or accepted in triage at the time of the milestone. The most advanced patching agent that has published metrics had 72 fixes accepted in half a year (its last public figure, from October 2025); since July 22, 2026, it has been in public preview for Google Cloud enterprise customers, while its variant with the specialized cybersecurity model remains restricted to governments and trusted partners. The ratio between both paces is around 25 to 1 per unit of time, and the comparison is generous to the patching side: those 72 fixes are patches in open-source projects, without on-chain governance, without timelocks, and without user liquidity locked during deployment.

The specialized model presented on July 22 points in the right direction —it finds, validates, and proposes a patch in the same pass, and researchers who tested it extracted remote execution vulnerabilities in public APIs in two hours—. But the bottleneck of a cross-chain bridge is downstream from writing the patch: it lies in someone with authority approving, signing, and deploying it. No model has that authority, and granting it opens a different security problem.

The following table crosses incidents and the amount stolen per quarter (DefiLlama, protocol exploits without phishing; the Q1-2025 peak is Bybit) with the leading model on LMArena at each moment. The scores are indicative snapshots —the leaderboard recalibrates retroactively— and temporal coincidence does not imply causality: no hack in the series has public attribution to AI. The logic for monitoring this column is simple: more surface area reviewed without fatigue and at a decreasing marginal cost means more holes found. The case suggesting the relevant capability threshold has already been crossed is Zcash: in May 2026, with Claude Opus 4.8 recently released, a security engineer directed the model toward the Orchard circuit and in about 28 hours it identified the flaw that allowed for ZEC counterfeiting, which had remained hidden from human audits for four years.

Can any crypto hack from July 2026 be attributed to an AI agent?

No. And it is worth stating clearly, because the topic lends itself to easy headlines. As of August 2, 2026, there is not a single public forensic report —from SlowMist, PeckShield, Blockaid, CertiK, or Chainalysis— that attributes any of the week's eight incidents to an autonomous artificial intelligence agent. The documented vectors are compromised keys, misconfigured permissions, ambiguous signature encoding, and a pool manipulatable via flash loan. All of these are within the reach of a competent human attacker and all have been seen before.

What is documented occurs outside the crypto perimeter and with sources that can be cited by date:

• Google Threat Intelligence Group, May 11, 2026: first documented case of a zero-day exploit —a two-factor bypass on a systems administration tool— developed with the help of a model, detected before mass exploitation. The same report describes the threat group APT45 sending thousands of repetitive prompts to analyze CVEs recursively and validate proofs of concept.
• Anthropic, June 3, 2026: analysis of 832 accounts blocked for malicious activity between March 2025 and March 2026. 67.3% (560 accounts) used the model to write malware; the proportion of actors classified as medium risk or higher rose from 33% in the first analyzed semester to 56% in the second.
• Anthropic, November 13, 2025: the GTG-1002 campaign, the first reported AI-orchestrated cyberespionage operation, targeting about 30 entities, with the model executing between 80% and 90% of tasks autonomously after being deceived into believing it was performing defensive testing.

From this, it can be deduced that the capability exists and has already been used against corporate and government targets. It cannot be deduced that it has been used against a cross-chain bridge. When we published OpenZeppelin's alarm regarding the "superhuman" attack surface in DeFi, the count as of June 1 was zero crypto hacks attributed to AI. Nearly two months and sixty million dollars later, that count remains at zero. July can be explained without the need for agents: protocols fell due to accumulated security debt.

The defensive side does have its verified crypto precedent: the Zcash Orchard circuit flaw that allowed for minting fake ZEC, hidden for four years, was found by a model. In the half that moves fast, crypto is already in the game.

What did the cleansky.io logs record during the week of July 20?

We have a small but proprietary window into the automated noise, and that week returned something worth telling. The access logs of cleansky.io recorded approximately 2,058 vulnerability probes between July 20 and 27: requests to paths that do not and cannot exist on a static content site. Nothing extraordinary in volume for a domain with moderate traffic.

What was striking was a campaign originating from five Google Cloud IP addresses presenting itself with the user-agent of Anthropic's crawler —the strings anthropic-ai and Claude-SearchBot— while requesting /config/secrets.yml, /terraform.tfstate, and /ssl/server.key. None of these paths make sense for a content indexer; all three are infrastructure credential harvesting. Anthropic's real crawler operates from the 216.73.216.x block that the company itself publishes as the origin of its crawlers, and those five IPs were not in it. The user-agent string is free text that anyone can write.

The useful takeaway is second-order: today, mass scanning disguises itself as AI because disguising as AI works to bypass filters. Many operators have whitelisted model crawlers to avoid losing visibility, and that whitelist has become a doorway. Verifying by IP range rather than declared string takes five minutes of configuration and is no longer optional.

Why don't CertiK, SlowMist, and TRM Labs give the same figure for 2026?

Anyone trying to measure whether correction is gaining ground will find that the three reference firms —security auditors CertiK and SlowMist and on-chain forensic analytics firm TRM Labs— publish different figures for the same semester. This is not an error by anyone: each counts a different perimeter and none hide it.

The conclusion they do share is the one that titles CertiK's July 17 analysis: fewer attacks, but much more surgical. Almost 44% of the semester's losses came from two April incidents —Kelp DAO and Drift Protocol— both due to operational and infrastructure failures. The full detail of the semester is in the balance of the 207 hacks from the first half of the year, and the long-term history in the chronology of the biggest crypto hacks.

The metric that says the most about reaction speed is not losses, but recovery. SlowMist counts approximately $118 million frozen or returned in the first half of 2026 across the 18 incidents where recovery was attempted (which totaled $389 million stolen): 12.3% of the total losses for the semester. In the eight cases from the week of July 19-27, two protocols offered bounties to the attacker, and none had recovered anything at the close of these figures.

What signals of the detection-correction gap should be monitored until December 2026?

The signal that would truly change this analysis is a single one: the first forensic attribution. No firm has yet signed a report attributing a crypto exploit to an autonomous agent, and when it happens, it will matter who signs it and with what evidence — model orchestration leaves a trail in prompts and code patterns, not on the blockchain. The other two yardsticks are already in the figures above: the recovery rate (the 12.3% baseline improves if the year closes above 20%) and the count of protocols that fall twice to the same class of bug, which the week of July 19 left at two.

Until then, the practical recommendation for anyone with funds in a protocol is the most boring and the most profitable: check if the project published a post-mortem of its last incident, if the promised fix reached all its deployments —not just the chain where the attack occurred— and how long it took to pause the contract last time.

Sources and links: CoinDesk (Allbridge Core, Jul-20) · CoinDesk (AFX Trade, bridge keys) · CryptoTimes (technical analysis of Wanchain signature flaw) · crypto.news (Verus, second time via same route) · CryptoTimes (Triple-A, 31-hour drain) · TechTimes (the 2023 fix that missed Solana) · The Block (PeckShield, June 2026) · Forbes (CertiK: "fewer but more surgical") · SlowMist (2026 half-year report) · Anthropic (832 accounts mapped to MITRE ATT&CK, Jun-3-2026) · Anthropic (GTG-1002 campaign, Nov-13-2025) · Google Threat Intelligence Group (May-11-2026) · Google DeepMind (CodeMender, 72 fixes) · Help Net Security (specialized vulnerability model, Jul-22-2026) · XBOW (over 1,000 reports submitted on HackerOne)