What to Know
- At least three crypto bridges and cross-chain protocols were drained in a six-hour span for a combined total exceeding $35 million.
- AFX lost about $24.15 million from a bridge it operates on Arbitrum.
- The Verus-Ethereum bridge was exploited for about $7.54 million through the same contract path and bug class as a May incident.
- B² Network lost roughly $3.86 million after an attacker gained unauthorized access to the upgrade authority of its token staking contract.
- The attacks did not break underlying cryptography; they involved logic flaws, compromised keys, upgrade powers and validation failures.
- Verus redeposited recovered funds into the same bridge on July 8, and the bridge was drained again about two weeks later.
- Verus total value locked was close to $100 million at the start of 2025 and was about $9 million as of Thursday.
- B² said it contained the incident, suspended staking and would fully compensate affected users.
Cross-Chain Protocols Face a Fresh Security Reckoning
Crypto bridges and cross-chain systems endured a severe round of attacks as multiple Bitcoin and Ethereum-linked protocols were drained within hours, extending a difficult period for infrastructure designed to move assets between blockchains. The combined losses exceeded $35 million, with AFX, Verus and B² Network among the affected platforms. A fourth team, Balance, was also identified among the projects hit within a broader twenty-four-hour window, reinforcing how quickly attackers can move across systems that rely on trusted controls and complex validation logic.
The incidents underline a central tension in decentralized finance: bridges are essential for liquidity and user access, yet they remain among the most attractive targets in crypto. These systems typically lock assets on one network and issue a corresponding claim or representation on another. If the verification process fails, or if an attacker gains control over administrative permissions, the bridge can release real assets against invalid claims or allow funds to be redirected without any need to defeat the underlying blockchain itself.
That distinction matters. None of the confirmed incidents required breaking Bitcoin, Ethereum or the cryptographic assumptions that secure public blockchains. Instead, the failures emerged in the surrounding infrastructure: smart contract rules, bridge import paths, private keys, upgrade authority and off-chain operational controls. For users, the outcome is the same, because once funds leave a contract, the transaction is typically final. For protocol teams, the pattern shows that code audits alone are not enough if governance powers and private keys remain exposed.
AFX Suffers the Largest Confirmed Loss
The largest confirmed loss came from AFX, a perpetuals exchange that operates a bridge on Arbitrum. The bridge lost about $24.15 million, making it the biggest single drain among the incidents identified in the six-hour cluster. The attack added to concerns that trading platforms using cross-chain architecture can inherit security risks from the bridge layer even when their market-facing functions appear separate from the custody path.
Perpetuals exchanges depend on liquidity, margin flows and fast settlement between networks. When a bridge connected to that ecosystem is compromised, the impact can extend beyond the stolen assets by raising questions about collateral safety, withdrawal reliability and the controls used to manage cross-chain reserves. In periods of stress, confidence can be as important as the technical fix, because users may withdraw liquidity if they believe similar weaknesses remain unresolved.
Market participants have increasingly focused on whether bridges have minimized privileged access, narrowed upgrade permissions and tested unusual transaction paths. The AFX incident fits into a broader pattern in which attackers do not need to attack the most visible trading interface. Instead, they search for the custody, minting, redemption or messaging layer that sits behind it. That layer often carries the highest risk because it is responsible for deciding whether assets should move between chains.
Verus Hit Again Through a Familiar Bridge Path
The most damaging signal for confidence came from Verus, whose Ethereum bridge was drained of about $7.54 million. The attacker used the bridge import path to trigger unbacked payouts on the Ethereum side, pulling assets including ether, tokenized bitcoin, stablecoins and other tokens from bridge reserves. The core issue was not a broken cryptographic primitive. It was a validation failure that allowed the bridge to release real funds against claims that were not properly backed on the Verus side.
The Verus case is especially concerning because the attack reused the same bridge contract and entry path as an earlier hack in May, which caused an $11.5 million loss. After that earlier incident, the attacker returned most of the funds in exchange for a bounty. Verus later redeposited the recovered money into the same bridge on July 8, based on on-chain records compiled by security researchers, and the bridge was drained again roughly two weeks later.
For bridge users, repeated exploitation of the same bug class is often more damaging than a single isolated failure. It suggests that remediation may not have fully removed the vulnerable condition or that operational decisions reintroduced risk before the system had regained resilience. Bridges are trust amplifiers: users must trust not only the code, but also the process for pausing, patching, redeploying and restoring funds after an incident.
The confidence impact is visible in Verus liquidity. The protocol held close to $100 million in total value locked at the start of 2025, while it held about $9 million as of Thursday. A decline of that scale cannot be reduced to one incident alone, but repeated bridge failures can accelerate withdrawals and make it harder for a protocol to convince users that assets are safe. In decentralized finance, total value locked is not merely a metric; it is also a signal of market trust.
B² Network Attack Highlights Upgrade Authority Risk
B² Network, a scaling network built to make Bitcoin cheaper and faster to transact on, said an attacker gained unauthorized access to the upgrade authority of its token staking contract. That authority controls how the contract behaves. Once an attacker controls it, a conventional smart contract flaw may not be necessary. The attacker can change the rules, redirect funds or abuse permissions that were originally intended for legitimate maintenance.
Roughly $3.86 million in B2 tokens were traced as sold, converted into ether and stablecoins, and moved onward. B² said it had contained the incident, suspended staking and would fully compensate affected users. That response may help limit user losses, but the incident still illustrates the broader risk of highly privileged keys. In many DeFi systems, upgradeability is introduced to allow fixes and improvements. The same flexibility becomes dangerous if control over upgrades is concentrated or insufficiently protected.
Technical traders and security-focused market participants often distinguish between immutable contracts and upgradeable systems. Immutable contracts can be hard to fix if bugs are discovered, but upgradeable contracts depend heavily on who controls the upgrade path. Multisignature wallets, timelocks, hardware key management and monitoring can reduce risk, but they do not remove it. If attackers obtain the necessary credentials or exploit weak operational procedures, the contract can be compromised without the blockchain itself malfunctioning.
Why Bridges Remain a Prime Target
Bridges remain high-value targets because they often concentrate large reserves in contracts that must accept messages or proofs from another chain. A bridge must decide whether a deposit, burn, lock or message on one network is valid enough to authorize a withdrawal on another. That decision process is complex, and complexity creates room for mistakes. If a bridge accepts an invalid message, processes a malformed import path or fails to verify backing assets correctly, attackers can drain reserves while the code executes exactly as written.
The latest incidents show that attackers are targeting the trust assumptions around cross-chain design. In some cases, the weak point is a logic rule. In others, it is a private key, an upgrade role or an administrative permission. These are not abstract governance details; they are direct security boundaries. When a single compromised control can move funds, the bridge effectively depends on that control as much as it depends on its code.
The threat environment is also becoming more difficult. Recent artificial intelligence evaluations have demonstrated that AI systems, under test conditions with safety limits lowered, can chain together stolen credentials and previously unknown software flaws in ways that resemble advanced intrusion workflows. That does not mean autonomous systems are independently attacking crypto protocols, but it does suggest that the tooling available for reconnaissance, credential abuse and multi-step exploitation may become more capable. For crypto, where transfers can be irreversible, that raises the cost of weak operational security.
The Larger Lesson for DeFi Security
The common theme across Verus, B², AFX and Balance is not the collapse of blockchain cryptography. It is the failure of trusted controls around the contracts. Bridges and staking systems can be audited for code correctness, yet still fail if their upgrade authorities, validation rules or off-chain keys are not protected with equal rigor. The security perimeter of a protocol includes every signer, every administrative role, every deployment path and every emergency recovery process.
For users, the practical lesson is to evaluate more than yield, speed or chain support. Cross-chain protocols should be judged on how they manage upgrades, whether they use timelocks, how they monitor abnormal withdrawals, how quickly they can pause risky functions and whether prior vulnerabilities have been fully resolved before funds are restored. Compensation promises may reduce direct user harm, but they do not erase the structural risk if the same control model remains in place.
For protocol teams, the pressure is mounting to reduce reliance on single points of failure. That can mean limiting upgrade powers, separating duties across independent signers, hardening private key custody, using formal verification where appropriate and treating incident response as part of product design rather than an afterthought. Bridges are likely to remain essential infrastructure for crypto, but the latest wave of losses shows that they will also remain a primary battleground for security.
Frequently Asked Questions (FAQs)
How much was lost in the latest cluster of crypto attacks?
At least three bridges and cross-chain protocols were drained in a six-hour span for a combined total exceeding $35 million. A broader twenty-four-hour window also included Verus, B², AFX and Balance among affected teams.
Which protocol suffered the largest confirmed loss?
AFX suffered the largest confirmed loss among the named incidents, with about $24.15 million drained from a bridge it operates on Arbitrum.
What happened to the Verus-Ethereum bridge?
The Verus-Ethereum bridge was exploited for about $7.54 million after an attacker used the bridge import path to trigger payouts on Ethereum that were not properly backed on the Verus side.
Why is the Verus incident especially concerning?
The Verus attack reused the same bridge contract and entry path as a May incident that caused an $11.5 million loss. Repeated exploitation of the same bug class raises concerns about whether the underlying weakness was fully resolved.
What happened to B² Network?
B² Network said an attacker gained unauthorized access to the upgrade authority of its token staking contract. Roughly $3.86 million in B2 tokens were traced as sold, converted into ether and stablecoins, and moved onward.
Did attackers break Bitcoin or Ethereum cryptography?
No. The incidents did not involve breaking the underlying cryptography of Bitcoin, Ethereum or related blockchains. The failures involved logic flaws, compromised keys, upgrade permissions and validation controls.
Why are cross-chain bridges so risky?
Cross-chain bridges must verify activity on one network before releasing or minting assets on another. If that verification process is flawed, or if privileged keys are compromised, attackers can drain reserves without attacking the base blockchain.
What did B² say it would do for affected users?
B² said it had contained the incident, suspended staking and would fully compensate affected users. The statement may help address user losses, but it does not remove the broader importance of securing upgrade authority.
What should users watch for when evaluating bridge security?
Users should consider whether a bridge has strong key management, limited upgrade powers, timelocks, monitoring for abnormal withdrawals and a clear history of resolving vulnerabilities before restoring funds to affected contracts.
Photo by Bastian Riccardi on Pexels