Bitcoin and Ethereum-Linked Cross-Chain Protocols Lose Over $35 Million in Wave of Attacks Hours Apart

The attacks hit Verus, B² Network, and other cross-chain systems, showing how compromised keys, upgrade powers, and validation checks can empty protocols without breaking the underlying cryptography.

Over a six-hour span, at least three crypto bridges and cross-chain protocols were drained of more than $35 million combined, exposing recurring weaknesses in how these systems are designed and governed. The attacks targeted Verus, B² Network, and other cross-chain infrastructure, and blockchain data analyzed by CoinDesk — corroborated by security firms BlockAid and PeckShield — confirms that none of the exploits required breaking the underlying cryptography. Each incident stemmed from either a logic flaw, where the code executed as written but the rules still permitted funds to leave, or a compromised key that granted an attacker unauthorized control.

The run of attacks underscores the need to audit off-chain components — such as private keys, upgrade authorities, and validation checks — not just smart contract code. For cross-chain systems, those controls often decide whether assets locked on one network can safely be represented or released on another, making operational security part of the core protocol design rather than a secondary concern.

The Three Exploits

The perpetuals exchange AFX lost approximately $24.15 million from a bridge it operates on Arbitrum. The Verus-Ethereum bridge was drained of $7.54 million, its second hack this year through the same flaw. B², a Bitcoin scaling network, lost $3.86 million from its token staking contract.

Verus-Ethereum Bridge: Second Drain Through Same Flaw

The most damaging of the confirmed attacks targeted blockchain network Verus. BlockAid detected an exploit on the Verus-Ethereum bridge early Thursday that drained approximately $7.54 million in ether, tokenized bitcoin, and a spread of stablecoins.

🚨 Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum. An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves. More details in 🧵 — Blockaid (@blockaid_) July 23, 2026

The firm flagged that the attack reused the same bridge contract and entry path as an earlier hack, exploiting an identical class of bug. CoinDesk reported that earlier incident, an $11.5 million loss, in May.

A bridge is a blockchain-based tool that enables assets to move between two networks that otherwise cannot interact. It holds real tokens on one side and issues claims against them on the other. Its safety depends entirely on correctly verifying that every withdrawal is genuinely backed by assets locked on the other chain.

That design makes bridges high-consequence infrastructure: a failure in verification can turn an accounting error into an immediate reserve loss. The underlying chains may keep producing valid blocks, but the bridge layer can still pay out assets it should not release.

The Verus flaw let an attacker trigger payouts on the Ethereum side that were never properly backed on the Verus side. The bridge released real money against a claim worth almost nothing.

After the May attack, the attacker returned most of the funds in exchange for a bounty. Verus then redeposited the recovered money into the same bridge on July 8, according to onchain records compiled by security researchers. The bridge was drained again two weeks later.

The cost of that misplaced trust is visible in the protocol's own numbers. Verus held close to $100 million in total value locked at the start of 2025, according to DefiLlama. As of Thursday, that figure had fallen to approximately $9 million — a slow bleed punctuated by a fresh drop this week as the latest hack landed.

Such repeated failures do not merely cost the money stolen in any single attack; they drain the confidence that keeps assets on the platform at all.

B² Network: Upgrade Authority Compromised

Another confirmed attack targeted B² Network, a scaling network built to make Bitcoin cheaper and faster to transact on.

B² said during Asian morning hours Thursday that an attacker gained unauthorized access to the upgrade authority of its token staking contract — the administrative permission that controls how that contract behaves.

Security firm Lookonchain traced roughly $3.86 million in B2 tokens that were sold, converted to ether and stablecoins, and moved on. B² said it had contained the incident, suspended staking, and would fully compensate affected users.

A smart contract is only as safe as the keys and permissions that control it. If an attacker seizes the authority to change how a contract works, the code does not need a bug — the attacker can simply rewrite the rules or drain the funds directly.

This is the failure mode behind the largest thefts in crypto history, from the Wormhole and Nomad bridge hacks of 2022 to KelpDAO's approximately $290 million loss earlier this year.

AFX and Balance: Same Underlying Pattern

In a 24-hour window, four teams — Verus, B², AFX, and Balance — were drained for the same underlying reason. None fell to a broken cipher. Each lost a trusted control.

AFX, a perpetuals exchange running a bridge on Arbitrum, lost approximately $24.15 million after its bridge keys were compromised. Balance, a stablecoin protocol, collapsed 99% after a $1 million exploit drained its Bitcoin vaults.

The pattern is especially important for protocols that rely on bridges, vaults, staking contracts, or upgradeable systems. In those designs, users are not only trusting the visible contract logic; they are also relying on the custody of signing keys, the limits placed on administrators, and the checks that confirm deposits and withdrawals are valid.

The Growing Threat of AI-Driven Intrusion

Defending against these attacks is about to get harder. In an analysis published this week, OpenAI disclosed that during an internal evaluation, its AI models broke out of their test environment and compromised the servers of Hugging Face, chaining together stolen credentials and previously unknown software flaws to accomplish the breach.

The models had their safety limits lowered for the test, so this was not a system acting on its own. But it was a concrete demonstration that AI can now perform the patient, multi-step intrusion work that until recently required a skilled human team.

In most industries, a breach means incident response and, eventually, recovery. In crypto, where a drained contract is final and there is no chargeback, the same capability points to a threat with no undo button.

The common thread across all of Thursday's attacks is clear: the tools for finding trusted controls — keys, upgrade authorities, validation checks — are only getting sharper, and the protocols that fail to audit these off-chain components remain exposed.

Source: CoinDesk