INCIDENT EVIDENCE GRAPH
Newsletter - July 2026
July 2026's three largest DeFi incidents totaled approximately $67.9M in losses across Arbitrum and Solana. AFX Trade lost ~$24.15M after a supply chain attack compromised validator signing authority. Ostium's OLP vault was drained of ~$23.75M through compromised oracle infrastructure that submitted attacker-controlled prices. BonkDAO lost ~$20M when an attacker spent $4.4M to acquire enough voting power to pass a malicious treasury transfer with no timelock. All three incidents demonstrate that a protocol's security boundary extends far beyond smart contract code.
- Victim: AFX Trade; Ostium; BonkDAO
- Actor: attacker
- Method: supply chain attack; compromised oracle infrastructure; governance attack