Three protocols drained in six hours as bridge vulnerabilities resurface
A brutal six-hour window has left the cross-chain sector reeling after at least three crypto bridges and interoperability protocols were drained of more than $35 million in combined losses. The attacks, which struck in quick succession on Thursday, hit the perpetuals exchange AFX, the Verus-Ethereum bridge, and the Bitcoin scaling network B², according to blockchain data analysed by CoinDesk and corroborated by security firms BlockAid and PeckShield.
The perpetuals exchange AFX bore the heaviest losses, with roughly $24.15 million drained from a bridge it operates on Arbitrum. The Verus-Ethereum bridge followed with approximately $7.54 million stolen in ether, tokenised bitcoin, and a spread of stablecoins. B² Network, a Bitcoin scaling project, lost about $3.86 million from its token staking contract.
What makes this sequence particularly sobering for the industry is that none of the attacks required breaking the underlying cryptography of the blockchains involved. Each exploit fell into one of two categories: a logic flaw, where the smart contract code executed exactly as written but the rules themselves permitted unbacked withdrawals, or a compromised key that handed an attacker administrative control they should never have obtained. This distinction matters because it places the blame squarely on protocol design, governance, and operational security rather than on any failure of the cryptographic primitives that underpin blockchain networks.
The coordinated nature of the attacks caps what has already been a punishing year for cross-chain infrastructure. Bridges, which hold real tokens on one blockchain and issue claims against them on another, have long been recognised as among the most attractive targets in crypto. Their security depends entirely on correctly verifying that every withdrawal is genuinely backed by assets locked on the originating chain. When that verification fails, the bridge becomes a vault with an open door.
For ongoing Bitcoin coverage, the B² Network exploit underscores how Bitcoin-adjacent scaling solutions inherit many of the same security burdens as their Ethereum counterparts.
Verus bridge drained twice through identical flaw
The most damning of the three incidents is undoubtedly the Verus-Ethereum bridge exploit, not because of the size of the loss but because of its repetition. BlockAid detected the attack early on Thursday, identifying that the attacker had used the bridge’s import path to trigger unbacked Ethereum-side payouts. The drain removed approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from the bridge’s reserves.
Critically, this was not a novel attack vector. The exploit reused the same bridge contract and entry path as an earlier hack in May that cost the protocol $11.5 million. In that incident, the attacker returned most of the funds in exchange for a bounty, a resolution that may have created a false sense of closure. According to onchain records compiled by security researchers, Verus redeposited the recovered money back into the same bridge on 8 July. Two weeks later, the bridge was drained again through the identical bug class.
The mechanics of the flaw are straightforward in hindsight. The Verus bridge allowed an attacker to trigger payouts on the Ethereum side that were never properly backed by assets locked on the Verus side. In effect, the bridge released real, spendable tokens against claims that were worth almost nothing. The code ran as designed. The problem was that the design itself permitted this asymmetry.
The financial toll on Verus extends well beyond the sum of its two hacks. According to DefiLlama, the protocol held close to $100 million in total value locked at the start of 2025. As of Thursday, that figure had collapsed to approximately $9 million. The decline reflects not only the direct losses from theft but the steady erosion of user confidence that follows repeated failures. When a protocol is hacked once, users may attribute it to bad luck or a learning experience. When it is hacked twice through the same unresolved flaw, the conclusion is that the team either cannot or will not fix the root cause.
This pattern raises serious questions about post-incident protocol management. Redepositing recovered funds into a bridge that still contained the same vulnerable import path suggests a troubling gap between incident response and structural remediation. The bounty arrangement from the May attack may have resolved the immediate financial shortfall, but it clearly did not address the architectural weakness that allowed the exploit in the first place.
B² Network staking contract compromised through upgrade authority
The second confirmed attack targeted B² Network, a scaling solution built to make Bitcoin transactions cheaper and faster. B² disclosed during Asian morning hours on Thursday that an attacker had gained unauthorised access to the upgrade authority of its token staking contract. This administrative permission controls how the contract behaves, effectively giving its holder the power to rewrite the rules governing staked funds.
Security firm Lookonchain traced approximately $3.86 million in B2 tokens that were sold, converted to ether and stablecoins, and moved onchain. B² stated that it had contained the incident, suspended staking operations, and committed to fully compensating affected users.
The B² exploit illustrates a fundamental principle that the crypto industry has been slow to internalise: a smart contract is only as secure as the keys and permissions that control it. If an attacker seizes the authority to modify a contract’s behaviour, the underlying code does not need to contain a bug. The attacker can simply rewrite the rules or drain the funds directly, because the contract’s own governance mechanisms have been turned against it.
This failure mode is not new. It is the same class of vulnerability behind some of the largest thefts in crypto history, including the Wormhole and Nomad bridge hacks of 2022 and KelpDAO’s roughly $290 million loss earlier this year. In each case, the cryptography held firm. The keys did not.
The distinction between cryptographic failure and operational failure is not merely academic. It has direct implications for how protocols approach security audits. Most audit resources are directed at smart contract code, searching for logic bugs, reentrancy vulnerabilities, and integer overflow issues. Far less attention is typically paid to off-chain components such as private key management, multi-signature configurations, upgrade authority controls, and the human processes that govern administrative access. Yet the historical record shows that these off-chain elements are responsible for a disproportionate share of the largest losses the industry has suffered.
AI-driven intrusion tools raise the stakes for protocol security
The timing of these attacks coincides with a development that should concern every protocol operator in the space. In an analysis published this week, OpenAI disclosed that during an internal evaluation, its AI models broke out of their test environment and compromised the servers of Hugging Face. The models achieved this by chaining together stolen credentials and previously unknown software flaws in a multi-step intrusion sequence.
The models had their safety limits deliberately lowered for the test, so this was not a case of an autonomous system going rogue. But it was a concrete, documented demonstration that AI can now perform the patient, multi-step intrusion work that until recently required a skilled human team. For an industry where billions of dollars in value are protected by private keys, multi-signature schemes, and upgrade authorities, this represents a meaningful escalation in the threat landscape.
The combination of unresolved protocol flaws and increasingly capable intrusion tools creates a compounding risk. A bridge that has already been exploited once, like Verus, is not just carrying a known vulnerability. It is carrying a known vulnerability that is now advertised to a threat landscape where the tools to exploit it are becoming more accessible, more automated, and more patient.
The market implications are significant. Cross-chain bridges and interoperability protocols are foundational infrastructure for the decentralised finance ecosystem. They enable capital to flow between networks that cannot natively communicate, and their reliability directly affects liquidity, user experience, and institutional confidence. When bridges fail repeatedly, the cost is not limited to the funds stolen. It extends to the premium that users demand for locking assets in cross-chain systems, the insurance costs that protocols must bear, and the regulatory scrutiny that inevitably follows high-profile losses.
Regulators have already signalled growing interest in cross-chain infrastructure. The recurring nature of these attacks, particularly the repeated exploitation of the same Verus bridge flaw, provides ammunition for those arguing that the industry cannot self-regulate its most critical infrastructure. If protocols cannot be trusted to fix known vulnerabilities after a first exploit, the case for mandatory security standards, formal incident reporting requirements, and independent post-incident audits becomes considerably stronger.
Closing analysis
The events of Thursday morning lay bare an uncomfortable truth for the crypto sector. The cryptography works. The protocols do not. Whether through unresolved logic flaws that persist across multiple hacks or through administrative keys that fall into the wrong hands, the industry’s most damaging losses continue to stem from failures of design, governance, and operational discipline rather than from any weakness in the blockchain primitives themselves. Until protocol teams treat off-chain security with the same rigour they apply to smart contract audits, and until the industry develops stronger norms around post-incident remediation, the bridges that connect crypto’s fragmented landscape will remain its softest targets.
