Two bridges tied to Ethereum, AFX and Verus, lost about $31.69 million within hours of each other. A third protocol, B² Network, halted staking after unauthorized access to its contract upgrade authority, exposing three separate control failures outside base-chain consensus.
Two bridges linked to Ethereum lost about $31.69 million within hours of each other, and a third protocol froze staking after unauthorized access to its contract upgrade authority. AFX and the Verus-Ethereum bridge absorbed those losses, while B² Network suspended token staking during security reviews.
AFX bridge drained of 24.15 million USDC
Blockaid detected the AFX exploit at about 21:30 UTC on July 22. An Arbitrum transaction then recorded 24.15 million USDC leaving the bridge, operated by AFX, a decentralized trading protocol on Arbitrum. AFX suspended its USDC custody bridge and said the incident stayed isolated from its trading infrastructure, mainnet, and the Arbitrum network; the affected component was a third-party cross-chain bridge, not Arbitrum’s native one.
In preliminary findings published July 24, AFX blamed coordinated social engineering and infrastructure compromise. The protocol said access appeared to begin in a development environment before escalating into internal build infrastructure and validator systems. As of July 24, it had not announced a completed return of funds or a finalized compensation plan.
Verus bridge released unbacked assets
Hours later, an Ethereum transaction showed the Verus bridge releasing 1,137.4528 ETH and seven token transfers. Blockaid valued the unbacked payouts at about $7.54 million.
SlowMist’s analysis said the bridge approved eight withdrawals without proving that matching assets backed them. The firm tied the failure to the same cross-chain import-validation class as a May exploit but said the two attacks used different mechanics.
B² halts staking after upgrade-authority breach
B²’s incident was not disclosed as a bridge exploit. The network said there was unauthorized access to its staking contract’s upgrade authority, so it suspended normal staking during security reviews and promised full compensation.
Users could instead request a manual exit through B²’s official Discord, with ownership-verified requests processed within one business day. B² did not state a loss amount, so its incident sits outside the $31.69 million bridge-loss total.
Each episode exposed a different control outside base-chain consensus: custody and validator infrastructure, bridge accounting, and upgrade authority. The next test for users is whether recovery plans return funds and whether cross-chain validation verifies economic backing.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
