Immunefi’s July read, surfaced this week, puts crypto hack losses around $110 million for the month while also flagging higher confirmed bug-bounty activity. The pairing is more useful than a pure horror headline. Losses remain material, yet the same market is paying more continuously for vulnerability reports before attackers get there first.

That mix matches the broader 2026 pattern. Incident counts can stay elevated even when average severity or total dollars oscillate, because the attack surface now includes bridges, key management, and operational credentials rather than only novel smart-contract math. Bounty platforms matter in that world. They do not replace audits. They keep a live market for disclosure after the audit PDF is filed away.

Readers should still distrust single-month precision across vendors. Different firms scope hack, exploit, and phishing differently. The directional signal is enough: security spend is no longer optional overhead for any protocol that holds outside capital, and July did not give the industry a quiet summer.

Watch whether September bounty payouts keep climbing, and whether the next large loss is another key-compromise story rather than a fresh logic bug.