Cascade XYZ suffered an exploit on July 16, 2026 that drained approximately $1.34 million USDC from its CLS vault, per PeckShield and Halborn incident logs. It is one of a series of smaller, targeted DeFi attacks that have marked the first half of July.
The pattern behind the number
July hack activity to date is dominated by low‑seven‑figure incidents rather than the eight‑ and nine‑figure headline losses that defined 2022 and 2023. That is a mixed signal. The average blast radius per incident is smaller, but the incident count is not — and the shift toward operator‑key compromises and social‑engineering attack paths (visible in the June Humanity Protocol breach) means the next large loss can come from a vector that a smart‑contract audit does not cover.
