Cross-chain protocols lose $35M in hacks

TLDR

Several cross-chain protocols tied to Bitcoin and Ethereum were hacked within hours, losing around $35 million and underscoring that bridges remain one of cryptos weakest points.

1. At least three bridges and cross-chain protocols, including AFX Trade, Verus Ethereum Bridge, and B Network, were exploited for a combined loss of about $35.5 million.
2. The attacks relied on compromised keys and flawed upgrade or validation logic rather than broken cryptography, exposing governance and operational security gaps.
3. Crypto users should treat bridges as high-risk infrastructure, scrutinizing security practices and avoiding large, concentrated balances while investigations and remediation plans continue.

Deep Dive

Confidence: high, based on consistent reporting from major outlets and security firms.

1. What Happened Across Bridges

CoinDesk reports that in roughly a six hour window on 23 Jul 2026, at least three bridges and cross-chain systems were drained for a combined total exceeding $35 million, including Verus, B Network, AFX and related components of their ecosystems. Bitcoin and Ethereum-linked protocols lose $35 million

Coverage from CryptoPotato notes that Arbitrum-based AFX Trade lost about $24.15 million in USDC, B Network on BNB Chain lost around $3.86 million, and the Verus Ethereum bridge was exploited for roughly $7.55 million, totaling about $35.55 million in 24 hours. Three protocols exploited for over $35 million

Separate reports confirm that AFXs attacker bridged stolen USDC to Ethereum and bought around 12,467 ETH, while Verus suffered a repeat bridge exploit similar to one in May, and B Networks staking contract was drained via control over its upgrade authority. AFX bridge exploit drains $24.15M USDC and Verus Ethereum bridge hacked again for $7.54M

2. Why Bridge Design Keeps Failing

CoinDesk emphasizes that these incidents did not break the underlying cryptography, but instead abused governance and control layers such as contract upgrade keys and validation logic, allowing attackers to trigger unbacked payouts or change staking contracts at will.

In Veruss case, the July exploit reused the same bridge contract path and apparent bug class as the May hack, suggesting that redepositing returned funds into a still-vulnerable bridge left it open to a second drain. Security commentary around AFX also highlights weak test coverage and unresolved audit issues, pointing to cultural and process failures around security.

Bridges must both hold pooled assets and verify messages across chains; any flaw in access control, upgrade processes, or import path validation can let attackers unlock assets without a matching deposit, turning these systems into high-value single points of failure.

3. What To Watch And How Users Can Respond

In the near term, the key things to watch are: (1) official postmortems and patch plans from AFX, Verus, and B Network; (2) whether affected protocols offer compensation or insurance; and (3) whether other bridges using similar patterns pause or upgrade their contracts.

For users, practical steps include limiting how much value sits in one bridge at a time, preferring well-audited, long-lived bridges with clear multi-signature or distributed control over upgrades, and monitoring security firm alerts before interacting with lesser-known cross-chain systems.

Conclusion

The roughly $35 million drained from multiple cross-chain protocols in hours shows that the main threat to bridges is not cryptography but human and governance controls around keys, upgrades, and validation logic. Until bridge operators harden these layers and demonstrate sustained security discipline, crypto users and builders should assume elevated risk around cross-chain infrastructure and factor that into how they move and park assets across networks.