Cross-chain bridges suffer $35M exploit losses

TLDR

In the past 24 hours, multiple cross-chain bridges and related protocols were exploited, losing more than $35 million across several networks.

1. AFX, Verus, and B Network suffered coordinated-style exploits that drained about $35.55 million from bridge and staking infrastructure.
2. The attacks abused key permissions and bridge logic, not Bitcoin or Ethereum base-layer cryptography, underscoring bridges as a recurring weak point.
3. Users should watch for postmortems, compensation plans, and governance changes before trusting these protocols or similar bridge setups with large balances.

Deep Dive

1. Which Protocols Were Hit And How Much Was Lost

In a roughly six-hour window on 2223 July, at least three bridge-related systems were drained of funds totaling over $35 million.

1. AFX Protocol, a perpetuals platform using Arbitrum, lost about $24.15 million in USDC from a cross-chain bridge, which the attacker moved to Ethereum and converted into roughly 12,467 ETH, according to crypto.news coverage.
2. The Verus Ethereum Bridge was hit again for about $7.54 million in ETH, tokenized BTC, stablecoins, and Maker (MKR), using the same contract path and bug class as a May exploit, as detailed in a Verus bridge report.
3. Bitcoin scaling project B Network lost roughly $3.86 million when an attacker seized upgrade authority over its staking contract, allowing unauthorized changes and drains, per a CoinDesk report.

Together, on-chain trackers put the combined losses near $35.55 million across these exploits.

2. Why Cross-Chain Bridges Keep Getting Exploited

Cross-chain bridges must lock assets on one chain and release representations on another, which means they hold pooled reserves and depend on off-chain validation, contract logic, and key management.

A CoinDesk analysis notes that none of these attacks broke underlying cryptography; they instead exploited logic flaws and compromised keys in bridge and governance controls, allowing as-written code paths or stolen permissions to release funds improperly from reserves in multiple bridge attacks. Verus re-used the same bridge contract and entry path as its May incident after redepositing returned funds, leaving assets exposed to a similar bug class. For AFX, Offchain Labs stressed that Arbitrums native bridge was unaffected and the failure sat within AFXs third-party bridge infrastructure, per the AFX exploit coverage.

3. What To Watch Next As A User Or Builder

Security firms Blockaid, PeckShield, and others are tracing stolen funds and coordinating with affected teams, while B Network has suspended staking and pledged full compensation to users in its ecosystem, as highlighted in Hackers Day reporting. AFX and Verus are investigating root causes; Verus in particular faces pressure to address repeated design issues in its import validation.

For crypto participants, the practical signals to monitor are:

1. Detailed postmortems explaining whether flaws were logic, key handling, or both.
2. Concrete governance changes, such as stricter upgrade controls, multi-signature or MPC key setups, and improved validation circuits.
3. Independent audits and disclosures on how much value remains in these bridges and whether compensation or insurance mechanisms are confirmed.

Confidence: high because multiple independent newsrooms and on-chain security firms converge on the same loss figures and technical patterns.

Conclusion

These exploits reinforce a consistent pattern: cross-chain bridges and upgrade-controlled contracts can be emptied without touching Bitcoin or Ethereums base layer, simply by abusing trust and logic at the protocol edge. For users and builders, the key implication is that cross-chain convenience comes with concentrated security risk; capital and trust are likely to shift toward bridges and protocols that can demonstrate stronger governance, audits, and resilience after events like these.