Search

23.07.2026

Three DeFi Protocols Lose $35.5 Million in a Single Day as Bridge Attacks Return

23.07.2026

Three DeFi Protocols Lose $35.5 Million in a Single Day as Bridge Attacks Return

AFX Trade, the Verus Ethereum Bridge, and B² Network were all hit within hours of each other on July 22–23, underlining the persistent vulnerability of the infrastructure connecting blockchains.

Three separate exploits drained a combined $35.5 million from decentralized finance protocols within a six-hour window on Wednesday, in what security researchers are calling one of the more concentrated bursts of losses the sector has seen this year.

The attacks struck AFX Trade, the Verus Ethereum Bridge, and B² Network—three unrelated protocols with three different failure modes, but a common thread: in each case, the problem was not a flaw in the blockchain itself but in the systems layered on top of it.

AFX Trade — $24.15 million

AFX Trade, a decentralized perpetuals exchange  that settles in USDC, was drained of about $24.15 million after an attacker compromised the validator signing keys behind a bridge the protocol operates on Arbitrum, a popular Ethereum scaling network.

Cross-chain bridges work by holding assets in custody on one blockchain while issuing equivalent tokens on another. To authorize withdrawals, most bridges require a set number of appointed validators to sign off. In AFX’s case, the on-chain logic functioned as designed: five hot-validator signatures met the quorum needed to authorize the withdrawal. The problem was with the private keys that generated those signature—attackers had compromised the private validator signing keys held offchain by the bridge’s operators. In other words, the smart contract did exactly what it was told to do.

The attacker then moved the stolen USDC from Arbitrum to Ethereum, with PeckShield reporting the funds were swapped into 12,467.5 ETH and traced to a single wallet, 0x6276…ebAC.

Blockaid, a blockchain security firm, flagged the security incident and noted the exploit was “specific to a bridge that AFX operates,” adding that it was working with the Arbitrum team to coordinate a response with the affected protocol.

Offchain Labs co-founder Steven Goldfeder moved quickly to clarify the scope of the incident on X:

“We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way.”


The incident is similar in character to the roughly $285 million Drift Protocol loss in April, where attackers spent months working their way toward privileged access rather than breaking any contract code. SunSec, founder of Web3 security community DeFiHackLabs, said the evidence pointed to compromised keys rather than a smart contract logic flaw.

The AFX team suspended bridge operations. No recovery mechanism or timeline has been announced.

“We continue to work closely with leading security firms, ecosystem partners, exchanges, and relevant authorities to monitor fund movements and support the ongoing investigation. We will keep the community updated as more verified information becomes available,” AFX wrote while extending a white hat settlement offer to 30% of the stolen funds to the party responsible for the recent bridge incident.

Verus Ethereum Bridge — $7.55 million

Hours after the AFX incident, Blockaid flagged a second exploit, this time targeting the Verus Ethereum Bridge, which allows users to move assets between the Verus network and Ethereum.

An attacker used the bridge’s import path to trigger unbacked Ethereum-side payouts, draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves. “Unbacked payouts” means the bridge released funds on the Ethereum side without a corresponding deposit having been made on the Verus side — essentially, the attacker tricked the system into handing over assets it had no right to release.

Blockaid noted this appears related to the previous Verus Ethereum Bridge incident in May 2026: same bridge contract, same entry path, and same bug class — though the July attack involved a new transaction and a different attacker and loot wallet.

That May incident, reported by CoinDesk, saw roughly $11.5 million drained through a forged cross-chain message that passed the bridge’s verification checks while requesting a payout far larger than any underlying deposit. After negotiations, the attacker in May returned 4,052.4 ETH, keeping the rest. Apparently, funds were subsequently redeposited into the bridge while the underlying vulnerability was never fully patched.

The fact that the same entry point was exploited twice, by different attackers, in the space of two months will raise serious questions about the Verus development team’s post-incident response. A critical bridge failure that recurs through an identical mechanism is not bad luck; it is an engineering and governance failure.

B² Network — $3.86 million

The third incident targeted B² Network, a Bitcoin layer-2 project. The B² Network lost roughly $3.86 million after an attacker seized its staking contract’s upgrade authority — the administrative permission that controls whether and how a smart contract can be modified.

Lookonchain traced the transactions after approximately 8.59 million B2 tokens reached an attacker-controlled address and were exchanged for 5,409 BNB, worth about $3.01 million, implying roughly $850,000 in slippage and price impact during the sale.

The B² team said the incident has been contained, that staking has been suspended pending a security review, and that no further impact is expected. The team also pledged to fully compensate affected users.

As CoinDesk noted, this failure mode—compromised keys and permissions rather than broken cryptography—remains the primary cause of major crypto thefts, being the same mechanism behind the largest heists in the sector’s history, from the Wormhole and Nomad bridge hacks of 2022 to KelpDAO’s roughly $290 million loss earlier this year.

A punishing year gets worse

The three incidents bring July’s total hack losses to roughly $97 million across 14 recorded incidents, already surpassing the $75.32 million in losses from June. The broader picture for 2026 is grimmer still: attackers carried out 207 separate hacks and stole $972 million in the first half of the year alone.

Cross-chain bridges—the pipes that allow assets to move between separate blockchains—have long been among DeFi’s weakest points. They concentrate liquidity, rely on off-chain key management, and are often built and audited under time pressure by small teams. What Wednesday’s events illustrate is that the problem has not become easier to solve: the largest losses continue to stem not from novel cryptographic attacks but from failures of key custody and access control — problems the industry has been discussing since at least 2022.

The Verus bridge exploit is particularly difficult to excuse. A known vulnerability, left unpatched after a nine-figure loss two months prior, was exploited again by a different attacker using the same method. That is a failure of a different order to a novel zero-day.

AFX has not publicly detailed how its validator keys were compromised, and both AFX and Verus have yet to release formal post-mortems as of publication.