After Bitcoin's sharp decline in June, crypto markets partially recovered in July 2026. But the month was far from quiet. Strategy began using Bitcoin sales as part of its liquidity management, one of the industry's oldest derivatives exchanges announced it was closing, and bridge and hardware-wallet exploits showed that major crypto losses are not limited to market-price movements.
Bitcoin gained 7.27% after June's sell-off
According to final Binance BTC/USDT trading figures, Bitcoin opened July near $58,625 and closed July 31 at roughly $62,888. That represented a 7.27% gain after a 20.43% drop in June. Its monthly low was $57,800 on July 1, while its high reached $66,956. The roughly 9% gain mentioned in early summaries reflected an interim market snapshot, not the final calendar-month return.
Even after that rebound, Bitcoin remained far below its early-June levels. Improving prices did not necessarily signal a full return of risk appetite: investors were still monitoring leverage, market liquidity and the balance sheets of companies holding substantial BTC reserves.
Strategy sold 3,588 BTC for $216 million — partly in June
On July 6, Michael Saylor's Strategy disclosed $216 million in Bitcoin sales in an SEC filing. The transactions took place in two periods: 1,363 BTC worth $80.8 million were sold on June 29–30, followed by 2,225 BTC worth $135.2 million on July 1–5. It is therefore inaccurate to attribute the full $216 million solely to July.
According to The Block, the transaction was Strategy's largest historical Bitcoin sale. The proceeds helped pay preferred-stock distributions and replenish the company's US dollar reserve. This differed from its long-standing accumulation approach, but did not mean Strategy had abandoned its substantial long-term Bitcoin position.
Strategy's mNAV slipped below 1 in late June
A key valuation measure for Strategy investors is enterprise mNAV, which compares the value of the company's overall capital structure against its Bitcoin holdings. The Block reported an enterprise mNAV reading below 1 on June 26. Unlike a simple comparison of stock-market capitalization and BTC value, the enterprise measure also reflects debt, cash and preferred securities.
A low mNAV can make issuing more stock to buy Bitcoin less attractive because selling shares at depressed valuations may dilute existing shareholders. It does not, however, mean equity issuance has stopped working. In its July 27 regulatory filing, Strategy reported selling $544.5 million in MSTR common shares during July 20–26. It acquired no additional Bitcoin during that week, holding 843,775 BTC.
Strategy's US dollar reserve rose to $3.75 billion
By July 26, Strategy had raised its US dollar reserve to $3.75 billion, which it said covered approximately 2.1 years of anticipated preferred-stock dividends and debt interest. This figure included expected proceeds from share sales that had not yet settled. The reserve was a liquidity buffer for financial obligations, rather than cash designated for immediate Bitcoin purchases.
A larger reserve reduces the near-term risk of forced Bitcoin disposals to meet payments. Its adequacy still depends on future preferred dividend rates, new commitments and access to capital markets. Selling BTC alone is not evidence that bankruptcy is imminent.
BitMEX announced its September 23, 2026 closure
On July 23, BitMEX announced that exchange operations would cease at 04:00 UTC on September 23. Founded in 2014, the platform helped popularize highly leveraged crypto perpetual swaps. It immediately stopped new account registrations, and its board attributed the decision to a strategic review of the business.
Reporting also indicated that BitMEX had been seeking a buyer since February 2025, but a sale had not materialized. The exchange did not attribute its closure announcement to a specific hack or a loss of customers' deposited assets.
BitMEX withdrawal, position and fee deadlines
Under the original wind-down timetable, position increases and new positions would be restricted from 04:00 UTC on August 26, leaving users generally able to reduce existing positions. Some contracts were subject to early settlement, while all remaining positions were scheduled for forced closure when exchange services ended on September 23.
BitMEX urged customers to withdraw available assets in advance. For KYC-verified accounts with balances left after closure, the announced charges included a 1% annual fee assessed monthly, or a $50 equivalent fee for smaller balances under the exchange's terms. Describing it as a flat $50 charge for every remaining account would misstate the policy.
July crypto thefts exceeded early estimates of $100 million
According to PeckShield's first month-end report, published August 1, July saw 30 major crypto hacks totaling approximately $210.3 million in estimated losses. By contrast, the firm's June count was 40 incidents worth $75.9 million. The discrepancy with early figures of about 14 incidents and nearly $100 million reflects reporting cutoffs, incident definitions and later revisions to loss estimates.
AFX Trade lost $24.15 million after bridge validator keys were compromised
On July 22, an attacker drained approximately 24.15 million USDC from the bridge operated by AFX Trade on Arbitrum. According to Blockaid investigators, compromised validator signing keys enabled the attacker to supply the required authorization signatures. The stolen funds were then moved to Ethereum and exchanged for roughly 12,467 ETH.
Arbitrum's native bridge was not compromised. The failure affected a third-party bridge belonging to AFX, illustrating how a smart contract can follow its programmed signature rules correctly while the keys it trusts have been stolen.
Verus was exploited again through a similar bridge weakness
On July 23, The Block reported a second exploit of the Verus–Ethereum Bridge totaling roughly $7.54 million. Blockaid identified the same bridge contract, message-import path and vulnerability class involved in the May 18 attack, which had caused losses of approximately $11.6 million. The second attack, however, used a different wallet.
The episode underscored the need to verify that the underlying bug has been fixed before a bridge is restored to operation. Recovering some stolen funds does not, by itself, prevent another attacker from exploiting the same weakness.
Coldcard's larger losses were quantified after July ended
Subsequent investigations revealed an even larger theft associated with certain Coldcard hardware wallets. According to a Galaxy Research report dated August 14, confirmed attack activity began on July 30. By the time of the report, at least 1,778 BTC, worth around $112.7 million, had been stolen from more than 8,600 addresses. Some thefts took place in August, so this entire amount cannot be assigned to the 31 days of July.
Researchers traced the vulnerability to a flaw in firmware-related random-number generation introduced in 2021, which left some generated private keys insufficiently unpredictable. Later discoveries concerning Coldcard materially changed the picture of July security losses, making it misleading to describe AFX as the month's largest incident across all categories.
Why these events mattered for affiliates and crypto payments
For affiliate networks and media buyers, the consequences were operational. An exchange closure can affect withdrawal windows and settlement availability, while compromised bridge keys or wallet software can threaten working capital. When evaluating crypto service providers, teams should check emergency withdrawal procedures, key custody, signature controls, device updates and independent security reporting — not just transaction fees or advertised liquidity.

Комментарии