Three Crypto Bridges Lose $35M in 24 Hours
Three separate bridge exploits drained a combined $35.55 million from AFX Trade, Verus, and BSquared Network across a brutal 24-hour window ending July 23, 2026. The incidents drew immediate comparisons to prior key-compromise attacks and renewed pressure on DeFi teams to treat bridge security as a first-order engineering problem, not an afterthought. Arbitrum’s native bridge was confirmed untouched throughout.
AFX Trade: $24.15M Gone in One Transaction
The largest loss belonged to AFX Trade, a decentralized perpetual futures platform on Arbitrum. At approximately 9:30 p.m. UTC on July 22, security firm Blockaid flagged a suspicious withdrawal: 24,150,000 USDC leaving a bridge contract AFX operated independently. The attacker had gathered five compromised hot-validator signatures, enough to satisfy the bridge’s two-thirds consensus threshold. After a programmed 200-second dispute window, the contract executed the transfer exactly as designed. The code was not broken; the keys were.
The stolen USDC moved to Ethereum immediately and was swapped for roughly 12,467.5 ETH at an average of approximately $1,937 per coin, reducing Circle’s ability to freeze the funds at source. On-chain trackers report those assets still sit in a single wallet. AFX has offered the attacker a 30% bounty to return the remainder, with no confirmed response as of publication. Offchain Labs co-founder Steven Goldfeder stated clearly on X that “the transaction in question originated from a third-party protocol,” confirming Arbitrum’s own infrastructure was never at risk.
On-chain security researcher Taylor Monahan added a harder edge to the story. Reviewing a recently published audit of the AFX bridge, she reported almost no test coverage, multiple auditor-flagged issues left unresolved, and auditors who received only partial code for review. The pattern she described points less to a sophisticated attack and more to institutional disregard for security culture. That context matters as much as the technical failure itself.
Bitcoin BTC$65,087.00▼1.60%
Ethereum ETH$1,884.24▼2.90%
Tether USDT$0.9993▲0.00%
BNB BNB$567.34▼0.60%
USDC USDC$0.9997▲0.00%
XRP XRP$1.11▼3.10%
Solana SOL$76.05▼2.50%
TRON TRX$0.3273▼0.40%
Figure Heloc FIGR_HELOC$1.04▼0.90%
Hyperliquid HYPE$58.06▼2.70%Verus and BSquared: Familiar Patterns Return
Hours after the AFX drain, Blockaid identified a second exploit targeting the Verus-Ethereum bridge, which lost $7.54 million in a basket of assets including ETH, tBTC, USDC, USDt, EURC, MKR, and scrvUSD. Blockaid confirmed to The Block that the attack used the same bridge contract, same entry path, and same vulnerability class as the May 2026 breach that cost Verus $11.58 million. A different wallet was used, suggesting a copycat or second actor exploiting a flaw that was never patched after the first incident.
BSquared Network on BNB Chain rounded out the trio, losing $3.86 million after 8.59 B2 tokens were drained, quickly swapped for over 5,000 WBNB, converted into 1,128 ETH, and bridged out via NEAR Intents. AMBCrypto reported details suggesting the BSquared incident may involve an insider. B2’s token price dropped more than 44% in the aftermath. Arbitrum’s ARB token also fell 5.63% on the day to $0.0864, reflecting broader sentiment pressure even though the network’s own infrastructure held firm.
The combined losses push cross-chain infrastructure back to the center of every honest infrastructure conversation. Bridges that shortcut validator decentralization or skip rigorous key-management discipline are not bridges — they are liabilities with a user interface. The technology to build secure cross-chain rails exists; what these three incidents confirm is that the broader ecosystem’s protocol maturity still runs well ahead of many teams’ operational discipline. That gap is where $35 million went on July 23.
