Cross-chain DeFi exploits drain $35M again

TLDR

In the past day, three cross-chain DeFi protocols were exploited for over $35 million, highlighting ongoing weaknesses in bridge and upgrade security.

1. AFX Trade, B Network and the Verus Ethereum bridge were drained in a roughly six hour window, with combined losses slightly above $35 million.
2. The exploits abused bridge logic, compromised keys and upgrade powers rather than breaking cryptography, continuing a wider pattern of bridge failures.
3. The key watchpoints now are how these teams patch contracts, handle restitution and whether TVL migrates away from fragile cross-chain infrastructure.

Deep Dive

1. What Was Exploited

Reports show at least three major cross-chain systems hit almost back to back, with losses totaling about $3536 million. AFX Trades Arbitrum-based custody bridge lost roughly $24.15 million in USDC that was bridged to Ethereum and swapped for over 12,400 ETH, in an incident AFX and Arbitrum confirmed as isolated to AFXs own bridge infrastructure.

Around the same window, Bitcoin scaling protocol B Network lost about $3.86 million when an attacker seized upgrade authority over its staking contract and drained B2 tokens into ETH and stablecoins, according to CoinDesks bridge incident summary.

The Verus Ethereum bridge was exploited again, with about $7.37.5 million drained via its import path, reusing the same bridge contract and bug class as a May attack, bringing total Verus bridge losses to roughly $19.1 million as detailed in Veruss second-bridge exploit coverage.

2. Why Cross-Chain Bridges Keep Failing

All three exploits shared a key theme: the attackers did not break the underlying cryptography but abused design and governance weaknesses. In Veruss case, the bridge correctly verified cryptographic proofs but failed to enforce that Ethereum-side payouts matched assets actually locked on Verus, allowing unbacked withdrawals from reserves.

B Networks loss came from an attacker gaining upgrade control over its staking contract, demonstrating how poorly managed admin keys can be as dangerous as a code bug. AFXs incident stemmed from compromised bridge keys on a third-party custody bridge. Together, these failures fit into a larger pattern where cross-chain systems are repeatedly drained due to logic flaws and key misuse, with bridge exploits already totaling hundreds of millions in recent months, including Mays eight major bridge incidents tracked by PeckShield.

3. Impact And What To Watch

Veruss total value locked has already shrunk dramatically after its repeated bridge issues, and B Network has publicly pledged full compensation to affected stakers, while AFX has offered a white hat bounty-style deal to its attacker to recover funds. These responses will shape user trust in each protocol.

Market sentiment around Bitcoin and Ethereum has turned more cautious, with prediction markets and price commentary explicitly citing these bridge incidents as infrastructure-risk factors in July, as highlighted in Vera-driven exploit analysis.

Key things to watch are: concrete remediation plans on each protocols bridge logic and admin controls, whether independent audits follow, and whether capital migrates toward better-secured bridges and L2s, or away from cross-chain DeFi altogether.

Confidence: high because multiple independent security and news reports describe consistent timelines, loss amounts and technical causes.

Conclusion

These latest cross-chain DeFi exploits are not isolated accidents but part of a recurring pattern where bridge logic and key management fail at scale. As long as protocols stake large reserves behind complex cross-chain machinery without rigorous controls, episodic $30$300 million drains are likely to continue. For crypto users, the main implication is that where and how assets cross chains matters as much as what they hold, and monitoring bridge design, governance and past incident history is now a core part of DeFi risk management.