Cross-chain BTC ETH bridges lose $35M

TLDR

Several Bitcoin and Ethereum-linked cross-chain protocols were hacked within hours, draining about $35 million and underscoring that bridges remain one of cryptos weakest points.

1. AFX Trade, Verus Ethereum bridge, and B Network were separately exploited, with combined losses slightly above $35 million.
2. The attacks abused bridge logic and compromised keys, not Bitcoin or Ethereums base-layer cryptography, highlighting systemic design and governance risk.
3. Crypto users should watch how each project handles compensation, fixes, and audits before trusting BTC or ETH on their bridges again.

Deep Dive

1. What Was Drained

Reports show at least three cross-chain systems tied to Bitcoin (BTC) and Ethereum (ETH) were hit within roughly six hours for over $35 million in total losses.

AFX Trades own custody bridge on Arbitrum lost about $24.15 million in USDC after its bridge validator keys were compromised, with funds bridged to Ethereum and swapped into around 12,467 ETH, according to security firm coverage and follow up reporting on AFXs exploit. A CryptoPotato summary notes AFX, BSquaredNetwork, and Verus together lost over $35 million in assets in what commentators called Hackers Day.

The Verus Ethereum Bridge was exploited again for roughly $7.5 million across ETH, tokenized BTC, stablecoins, and MKR, reusing the same contract path and bug class as a May attack that took $11.6 million, pushing Verus cumulative bridge losses above $19 million as detailed in a bridge-focused analysis of Verus second exploit in 66 days.

Bitcoin scaling project B Network lost about $3.86 million when an attacker seized upgrade authority over its staking contract, changing logic to drain funds, as described in CoinDesks overview of Bitcoin and Ethereum-linked protocols losing $35 million in multiple attacks hours apart.

2. Why Bridges Are The Weak Link

Across these incidents, the common thread is not broken cryptography but trust and logic failures in bridge and governance design.

CoinDesk notes that every attack relied either on compromised keys or a logic flaw where the code ran as written yet still allowed unbacked payouts or unauthorized upgrades, rather than invalid signatures or hashes. Backward Labs work on Verus highlights that the bridge correctly verified proofs but failed to ensure that Ethereum-side payouts matched assets actually locked on Verus, a classic business-logic gap.

Because BTC and ETH often move via third party bridges or L2s, users can face full losses even while the main chains remain secure. PeckShield has tracked hundreds of millions of dollars lost to bridge exploits in 2026, and this cluster of attacks reinforces that bridges concentrate large pools of value with relatively fragile controls.

3. What To Watch And How To React

Initial reactions vary. B Network suspended staking and publicly pledged full compensation to affected users. AFX halted its bridge, is working with security firms, and has offered the attacker a white hat-style deal to return most funds, mirroring prior incidents where hackers accepted partial bounties to send assets back. Verus is under renewed scrutiny, as this exploit repeated a flaw class that remained exploitable for more than two months.

For users, practical checks include: favoring well audited, battle-tested bridges, monitoring whether validator keys and upgrade powers are distributed and well protected, and being cautious when a single team-operated bridge holds large balances relative to its security track record.

Low depth plus bridge vulnerabilities can lead to unrecoverable losses, so many participants will wait for post-mortems, code fixes, and fresh audits before trusting these BTC and ETH bridges again.

Conclusion

About $35 million drained from BTC and ETH-linked bridges came from compromised keys and flawed bridge logic, not failures in Bitcoin or Ethereum themselves. The incidents reinforce a clear causal link: concentrated trust in bridge operators and poorly enforced economic invariants can erase user funds even when cryptography holds. Going forward, the key questions are whether projects harden their governance and validation rules, and whether users and institutions start demanding stronger security guarantees before moving core assets across chains.