Coinsbuy was hit by a cross-chain theft that drained more than $8 million from wallets on Tron and Ethereum, according to blockchain investigator BlockWatchdog. The firm said the attack began with a 5 USDT test transfer on Tron before more than 6 million USDT was taken from eight wallets. On Ethereum, another 1.89 million USDT and 77 ETH were removed from three wallets. BlockWatchdog linked both sets of transactions to the same attacker through the cross-chain swap service Bridgers. It said roughly $6.34 million, equal to 79% of the stolen funds, was later moved through FixedFloat, while another 150 ETH was sent through ChangeNOW. The investigator also said 282.2 ETH, valued at about $542,000 at the time, remained untouched across five addresses. Hours later, Coinsbuy refilled affected wallets with about $3.93 million sent back to the same 10 addresses. Seven of those deposits matched the original stolen amounts within 0.05%, a pattern BlockWatchdog said suggests the team did not believe private keys had been leaked. The exact attack path remains unknown, though the investigator said the attacker may have reached Coinsbuy’s withdrawal system. Coinsbuy had not publicly explained the breach at the time of the analysis and did not immediately respond to Decrypt’s request for comment.

Blockchain security firm ZeroShadow said the crypto sector lost about $97 million to security incidents in July 2026, with losses rising roughly 18.7% from $81.73 million in June. Of that total, around $94 million came from hacker attacks and contract-related flaws, while phishing accounted for about $3 million. The report counted more than 14 protocol-related incidents, down from 67 in June, but noted that the amount lost per incident rose sharply. Cross-chain bridges remained the hardest-hit area. AFX Trade, Verus and B² Network were among the projects hit within a matter of hours, with combined losses exceeding $35 million. ZeroShadow said the main attack path is shifting away from smart-contract coding bugs and toward off-chain infrastructure compromises, validator or signing-key leaks, and governance manipulation. The report highlighted seven major hacking cases, including the $23.75 million Ostium exploit tied to compromised off-chain price-signing infrastructure, the $24.15 million AFX Trade bridge attack involving validator keys, and the $20 million BonkDAO treasury drain carried out through governance rules rather than contract failure. It also listed four notable phishing or scam incidents and offered separate recommendations for users, project teams and the broader industry.

The coming week carries a dense schedule for crypto markets and adjacent sectors. Circle, SpaceX, Hut 8, and American Bitcoin are all set to release quarterly results, while token unlocks for Succinct (PROVE), Ethena (ENA), and Hyperliquid (HYPE) are also on the calendar. At the same time, several products and services are approaching end-of-life milestones, including DeFi dashboard Zapper, crypto wallet Ctrl Wallet, and Polygon liquid staking token MaticX. Exchanges are making changes as well: Binance will stop supporting the Sophon mainnet and migrate SOPH to Ethereum on a 1:1 basis, and Coinbase plans to suspend trading in IDEX, LRC, OMNI, PIRATE, and FIS. The week also includes Polymarket’s shift to TWAP-based settlement for crypto up/down markets, a planned compensation update from AFX Trade after its bridge exploit, and an upcoming XRP Ledger software release that restores revised features previously removed over security flaws. Macro data are also due, with the U.S. set to publish July unemployment, nonfarm payrolls, and wage figures on Aug. 7.

PeckShield tracked 30 major hacking incidents across the crypto industry in July, with total losses reaching $210.3 million. The figure was up 177.2% from June, when losses stood at $75.87 million. Among the incidents listed, the COLDCARD case accounted for about $70 million, making it the third-largest cryptocurrency theft recorded so far this year, according to the update cited by ChainCatcher. Other large losses in July included AFX Trade on Arbitrum at about $24 million, Ostium at about $24 million, BONK at about $21.2 million, and Wanchain at about $13 million. The list also included Triple-A, Bonzo Lend, Verus, WEMIX, and Summer.fi, each with reported losses ranging from roughly $6 million to $10 million. The figures were published in a market security update referenced by ChainCatcher.

AFX Trade said it plans to announce a goodwill compensation plan on Aug. 3 in response to its recent security incident. The decentralized derivatives trading layer also said it has identified the group involved in the attack as UNC4899, a branch of the Lazarus Group. According to the project, UNC4899 is affiliated with North Korea’s Reconnaissance General Bureau. In an earlier update cited by Foresight News, blockchain security firm PeckShield said AFX Trade’s Arbitrum bridge had been exploited, with losses estimated at about 24 million USDC. The latest statement adds two points to the incident timeline: a target date for the compensation plan and the project’s attribution of the attacker.

A packed 24-hour news cycle brought fresh signals from crypto markets, policymakers, security researchers and public companies. CryptoQuant analyst Axel Adler said Bitcoin’s rebound is still facing four pressures: compressed volatility, weak U.S. spot demand, thin buy-side liquidity and continued loss realization by investors. In Washington, Aave founder Stani said the CLARITY Act has entered the "last mile," arguing that even in imperfect form it could become the first U.S. law to directly address DeFi and give institutions, fintechs and banks a clearer legal path into on-chain finance. In Europe, attention is shifting from winning a MiCA license to paying the ongoing cost of compliance. Market participants cited in the report said that dynamic could push the sector toward consolidation, including mergers, joint ventures and bank partnerships, with the U.K. likely to follow a similarly strict path through its own framework. Binance founder Changpeng Zhao, meanwhile, said acquisitions of smaller centralized exchanges remain possible, but post-deal security incidents are hard to attribute, making due diligence and risk controls much harder. Other major developments included updated figures on public-company Bitcoin holdings, Lido’s response to a stETH reward calculation issue, Cascade’s statement that funds tied to the CLS incident had been recovered, and new reports on wallet-targeting malware campaigns and U.S. crypto seizure actions.

EmberCN said the hacker behind the AFX Trade exploit has converted 12,467.4 ETH into BTC. The move followed the July 23 attack on AFX Trade’s Arbitrum bridge, which resulted in losses of about 24 million USDC. After the exploit, the attacker gradually moved the stolen funds from Arbitrum to Ethereum before carrying out the ETH-to-BTC swap. The update tracks how the stolen assets have been handled after the breach and points to continued fund movement across chains after the initial attack.

AFX Trade said its initial investigation found that the earlier incident involved a coordinated social engineering attack combined with an infrastructure breach. According to the company, the attacker appears to have first gained access through the development environment, then escalated privileges into internal build infrastructure and validator systems. The team said its immediate focus is protecting affected users. It is now verifying impacted balances, trying to recover funds, and preparing a structured remediation plan. Earlier, Foresight News reported that blockchain security firm PeckShield had detected a hack targeting AFX Trade’s Arbitrum bridge, with losses estimated at about 24 million USDC. The latest statement adds the platform’s first outline of how the intrusion may have unfolded and what its response priorities are.