Decentralized finance is once again grappling with security concerns after three cross-chain bridge exploits resulted in $35.55 million in combined losses over a single day, coinciding with renewed on-chain activity tied to the earlier Drift Protocol hack.

Three Bridge Exploits Hit $35.55 Million

At press time, three separate DeFi exploits had already produced $35.55 million in losses. Although the total is significantly lower than the losses seen during the Q1–Q2 hack cycle, market participants are describing it as the worst single day for DeFi security in months.

AFX sustained the largest loss, with attackers stealing $24.2 million in USDC from its Arbitrum bridge before moving the funds to Ethereum. BSquared Network was the second-largest victim, losing approximately $3.9 million after an attacker drained 8.6 million B2 tokens. VerusCoin also suffered a bridge exploit valued at roughly $7.5 million.

All three attacks targeted the same layer of the DeFi stack: cross-chain bridges, which enable assets to move between separate blockchain networks. Bridges have consistently ranked among the most exploited components in DeFi because they custody large pools of assets on one chain and mint representations on another, creating a single point of failure that attackers can target. Despite operating in different ecosystems, the attack vector was identical in each case, once again highlighting bridge infrastructure as one of DeFi's most persistent security vulnerabilities.

Context: The Q1–Q2 DeFi Security Crisis

The latest incidents evoke memories of the Q1–Q2 cycle, when three consecutive hacks wiped out over $600 million. That earlier wave triggered a sharp liquidity outflow, with total value locked (TVL)—a key metric measuring the aggregate assets deposited across DeFi protocols—falling to just over $65 billion, levels not seen since Q2 2024. Ethereum alone lost more than $10 billion in TVL within a 48-hour window.

Drift Exploit Attacker Resumes Moving Stolen Funds

The timing of the bridge exploits has drawn additional attention because the hacker behind the Drift Protocol exploit has resumed moving stolen funds. Earlier this year, Drift Protocol suffered one of the largest DeFi exploits on record after attackers drained $285 million, prompting a broad wave of risk-off sentiment.

According to Onchain Lens, the attacker is now funneling ETH through the Tornado Cash Router in repeated 100 ETH batches, with multiple transactions being executed every minute. Tornado Cash is a privacy tool on Ethereum designed to obscure the link between sender and recipient addresses, making it a common mechanism for laundering stolen funds. While these transfers do not necessarily indicate an imminent selloff, they have brought the Drift hack back into focus amid the new wave of bridge exploits.

DeFi Recovery Now Under Pressure

According to DeFiLlama data, DeFi had been regaining momentum, with TVL climbing by more than $10 billion in July—the strongest monthly increase since the Q1–Q2 hack wave. The latest $35.55 million in exploits has introduced fresh uncertainty into that recovery.

If additional exploits follow, market attention could shift once again from capital inflows to protocol security, reviving the same DeFi FUD narrative that dominated earlier this year.

Summary

Three cross-chain bridge hacks wiped out $35.55 million in a single day, while the attacker behind the $285 million Drift exploit resumed moving stolen funds. The incidents come after DeFi TVL had recovered by over $10 billion in July, raising concerns that renewed security incidents could unsettle the sector's recovery.