Three Cross-Chain Bridges Lost 35 Million in a Single Night and the Pattern Should Worry Every Crypto Investor

Three cross-chain bridges lost more than 35 million USD in a single six-hour window on July 23, 2026, exposing the same recurring weakness that has plagued the crypto industry for years: the bridges between blockchains are still the soft underbelly of the entire system.

By Keisha Williams | July 25, 2026

The Hook: A Very Bad Night for Cross-Chain Tech

Within hours of each other, three separate protocols — AFX Trade, Verus, and B2 Network — were drained by attackers who exploited fundamental design flaws in how these systems move money between blockchains. According to CoinDesk, which analyzed on-chain data alongside security firms BlockAid and PeckShield, the combined losses exceeded 35 million USD. None of the attackers broke the cryptography itself. Each attack relied on either flawed logic — code that worked exactly as written but let money walk out the door — or compromised private keys that handed attackers administrative control they should never have had.

Think of a blockchain bridge like a currency exchange booth at an airport. You hand over dollars on one side, and the booth issues a claim ticket that lets someone withdraw euros on the other side. The booth is only safe if it rigorously checks that every withdrawal is backed by a real deposit. These three bridges failed at that basic check — in different ways, but with the same result.

On-Chain Evidence: Three Exploits, One Pattern

The largest of the three attacks hit AFX Trade, a perpetuals exchange running on Arbitrum. According to security researchers, an attacker compromised the keys controlling AFX’s bridge and walked away with roughly 24.15 million USD. When someone steals the keys to a bridge, they do not need to find a bug — they simply open the vault and take what is inside.

The most damning exploit targeted the Verus-Ethereum bridge, which lost approximately 7.54 million USD in ether, tokenized bitcoin, and several stablecoins. What makes this attack remarkable is that it was the second time the same bridge was hacked through the same class of flaw. Back in May 2026, Verus lost 11.5 million USD to an identical exploit on the same contract. After that first hack, the attacker returned most of the funds in exchange for a bounty. Verus then redeposited the recovered money back into the same vulnerable bridge on July 8 — only to be drained again two weeks later.

That is not a typo. The protocol put recovered funds back into a bridge it knew had a structural weakness, and the same type of attack worked again. Blockchain researcher Tayvano documented the on-chain trail showing the redeposit and subsequent drain, and the data paints a picture of a protocol that learned exactly the wrong lesson from its first breach.

The third attack hit B2 Network, a Bitcoin scaling project built to make transactions cheaper and faster. An attacker seized the upgrade authority of B2’s staking contract — the administrative permission that controls how the contract behaves — and drained roughly 3.86 million USD worth of B2 tokens. Security firm Lookonchain traced the stolen tokens as they were sold off and converted into ether and stablecoins. B2 Network said it suspended staking and would fully compensate affected users.

• AFX Trade — approximately 24.15 million USD lost to compromised bridge keys on Arbitrum
• Verus-Ethereum bridge — approximately 7.54 million USD lost, second hack through the same flaw in two months
• B2 Network — approximately 3.86 million USD lost after attacker seized staking contract upgrade authority
• Common thread — every attack exploited logic flaws or compromised keys, not broken cryptography

The Core Conflict: Bridges Keep Breaking the Same Way

The pattern across all three attacks is depressingly familiar to anyone who follows crypto security. Bridges are the most repeatedly hacked category of crypto infrastructure, and the reasons never change. A bridge holds real assets on one blockchain and issues claims against them on another. Its safety depends entirely on verifying that every withdrawal is backed by a genuine deposit on the other side.

The Verus attack shows what happens when that verification fails. The flaw let an attacker trigger payouts on the Ethereum side that were never properly backed on the Verus side. The bridge released real money against claims worth almost nothing — like a bank honoring a check from an empty account.

But the deeper problem is human, not technical. Verus knew about the flaw. It had already been hacked through it once. And yet it redeposited recovered funds into the same contract, treating a bounty return as proof the problem was solved rather than evidence that it persisted. That decision cost users another 7.54 million USD.

The B2 Network attack highlights a different but related failure mode. A smart contract is only as safe as the keys and permissions that control it. When an attacker gains upgrade authority — the ability to change how the contract operates — they do not need to find a vulnerability. They can simply rewrite the rules. Key management, not cryptography, remains the dominant attack vector across the industry.

Market Implications: Trust Is the Scarcest Asset

The damage from these attacks extends well beyond the immediate losses. Verus held close to 100 million USD in total value locked at the start of 2025, according to DefiLlama data. After this latest hack, that figure sits at roughly 9 million USD. That is not just theft — it is a slow-motion evacuation by users who have lost confidence in the platform’s ability to protect their money.

This matters for regular investors because cross-chain bridges are the plumbing that connects different parts of the crypto ecosystem. When you move tokens from Ethereum to Arbitrum, or from Bitcoin to a Layer 2 network, you are trusting a bridge. If bridges keep failing, the entire promise of a connected, interoperable crypto economy weakens.

For anyone holding assets on a platform that relies on bridges, the lesson is straightforward: understand what backs your tokens. If you hold wrapped or bridged assets, you are essentially holding a claim on something locked in a bridge contract. The safety of that contract — and the competence of the team managing its keys — determines whether your tokens are worth anything.

Bitcoin is currently trading near 64,101 USD, and ether around 1,858 USD, according to CoinGecko data. The broader market barely flinched at these bridge exploits — a sign that institutional investors increasingly treat bridge failures as isolated incidents rather than systemic threats. But for the users directly affected, the losses are very real and very personal.

The Verdict: Audits Are Not Enough

The crypto industry has spent years telling itself that smart contract audits solve the bridge problem. They do not. The Verus bridge was presumably audited, and it was still drained twice through the same flaw. The issue is not that auditors miss bugs — it is that bridges concentrate enormous value behind a single contract and a small set of keys, creating a target that is too tempting and too easy to exploit.

Real security for bridges requires structural changes: multi-signature controls so no single key compromise can drain funds, time-locked withdrawals that give teams a window to respond, and architectural redesigns that do not require trusting a single contract with hundreds of millions of dollars. Some projects are already moving in this direction. Until the rest catch up, the bridge problem will keep recurring.

For everyday investors, the practical takeaway is simple. Minimize your exposure to bridged assets when possible. Use decentralized exchanges native to the chain you are already on. And if a protocol gets hacked, do not assume that a bounty return means the problem is fixed — because as Verus just demonstrated, sometimes it means the opposite.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice.