Custody And Bridge Hacks Intensify Crypto Risk

TLDR

Custody wallets and cross-chain bridges have just seen a cluster of multi-million dollar hacks, showing crypto risk is increasingly about operational weak points rather than only code bugs.

1. In days, bridge exploits at AFX and Verus plus a Triple-A hot wallet breach have drained over $45 million, with prior bridge hacks already in the hundreds of millions this year.
2. Most losses are now tied to compromised keys, flawed bridge logic, and custody processes, reinforcing that audits of smart contracts alone do not make protocols or custodians safe.
3. Crypto users and institutions should watch how platforms handle key management, withdrawal controls, and bridge architecture, and adjust exposure or venue choices when transparency is thin.

Deep Dive

1. Recent Hacks And Their Scale

On July 2223, 2026, Arbitrum-based AFX Trade lost about $24.15 million in USDC when validator signing keys for its custody bridge were compromised, even though the bridge contract logic worked as designed. A detailed account shows the attacker met quorum with five hot-validator signatures, triggering a withdrawal that the bridge accepted after the dispute window, then moved funds to Ethereum and swapped them for ETH, all while Arbitrums native bridge remained unaffected as a third-party protocol issue.

The same day, the Verus-Ethereum bridge suffered its second exploit in 66 days, adding roughly $7.37.5 million of losses to a prior $11.6 million breach, for about $19.1 million stolen via a recurring design flaw in how imports were validated against actual locked reserves. Monitoring firms describe the failure as an authorization bypass, where cryptographic proofs were valid but business logic did not ensure assets were truly backed.

Separately, payment gateway Triple-A saw more than $9.7 million taken from hot wallets across six chains, with assets rapidly swapped and bridged into a single Ethereum address, mirroring earlier infrastructure hacks like Gravity Bridge and Hedera incidents. In May alone, bridge exploits across multiple projects totaled $328.6 million, underscoring that these are not isolated events but part of a systemic pattern.

2. Why Custody And Bridges Are Weak Links

Security reports now highlight that the majority of stolen funds come from compromised keys, signer devices, bridge validators, admin accounts, and backend infrastructure, not solely from smart contract bugs. Hackens Q2 2026 data attributes about 88 percent of roughly $764 million in losses to operational surfaces outside traditional code audits, and notes that some exploited projects had passed prior reviews.

Cross-chain bridges amplify this risk because they hold large pooled reserves and rely on complex message validation between networks that cannot natively communicate. When verification logic or economic backing checks are incomplete, an attacker can craft imports that look valid cryptographically but authorize unbacked payouts from bridge reserves, as seen in the Verus exploits.

Custody providers and payment gateways face a parallel problem: hot wallets and validator keys must stay online for fast settlement, which creates constant attack surface. Incidents like the Triple-A breach show how one compromise can propagate across chains via DEX swaps and bridges before traditional controls can react.

3. Signals To Watch And Practical Safeguards

Institutional investors are already shifting due diligence toward operational resilience, scrutinizing timelocks, withdrawal whitelists, multiparty controls, and how often signer sets and bridge contracts are reviewed or upgraded. Custody clients increasingly ask for details on incident response, audit scope, and business continuity, especially under regimes like Europes Digital Operational Resilience Act.

For individual users, practical safeguards include limiting funds held on hot-wallet-based platforms, being cautious with lesser-known cross-chain bridges, and preferring venues that disclose how keys are stored, who can sign large transfers, and whether withdrawal delays or limits exist for emergencies. Watching for prompt, transparent post-incident communication is also important; prolonged silence after a breach can signal governance or reserve-coverage issues.

Risk note: Concentrated reserves plus weak operational controls can turn a single bridge or custodian failure into large, unrecoverable losses that ripple across connected protocols and tokens.

Conclusion

Custody and bridge hacks are increasingly the main drivers of large crypto losses, driven by key compromises and flawed operational logic rather than broken cryptography. As these infrastructures carry more value, risk shifts from isolated protocol bugs to systemic weaknesses in how assets are held and moved between chains. Users and institutions who treat key governance, bridge architecture, and incident transparency as core selection criteria are better positioned to manage this evolving risk landscape.