Arbitrum

DeFi

Million

USDC

Tornado

<p class="wp-block-paragraph">Three separate <a href="https://coinpedia.org/news/crypto-hacks-surged-to-763m-in-q2-2026-as-operational-failures-spike/" rel="noopener noreferrer nofollow">crypto bridge hacks</a> wiped out more than $35.6 million in a single day. The attacks hit AFX Trade, BSquared, and VerusCoin, exposing serious security flaws across the DeFi sector. The attackers have already moved most of the stolen funds.</p><p class="wp-block-paragraph">Blockchain investigators say each exploit followed a very different attack method, raising fresh concerns over bridge security.</p><h2 id="h-afx-bridge-loses-24-2-million" class="wp-block-heading">AFX Bridge Loses $24.2 Million</h2><p class="wp-block-paragraph">The biggest hack hit AFX’s bridge on Arbitrum, where attackers stole 24.15 million USDC, worth about $24.2 million.</p><p class="wp-block-paragraph">According to blockchain security firm Blockaid, the bridge approved the withdrawal using five signatures from its seven-validator system. This suggests the attackers may have gained access to validator keys or the bridge’s backend system.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p>Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting <a href="https://x.com/AFX_XYZ?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@AFX_XYZ</a>, a protocol on <a href="https://x.com/arbitrum?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@arbitrum</a>. The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol.<br><br>Our team has been working with the incredible folks on… <a href="https://t.co/0Qd9ve5gPB" rel="noopener noreferrer nofollow">https://t.co/0Qd9ve5gPB</a></p>— Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2080080240265621680?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 22, 2026</a></blockquote></div></figure><p class="wp-block-paragraph">After stealing the funds, the hacker quickly moved the USDC from Arbitrum to Ethereum.</p><p class="wp-block-paragraph">In response to this, the AFX team <a href="https://x.com/AFX_XYZ/status/2080126901205770734" rel="noopener noreferrer nofollow">said it is working </a>with the Arbitrum team and security firms to investigate the exploit and trace the stolen funds.</p><h2 id="h-bsquared-loses-nearly-3-9-million-in-b2-token-hack" class="wp-block-heading">BSquared Loses Nearly $3.9 Million in B2 Token Hack</h2><p class="wp-block-paragraph">The second attack targeted the BSquared Network, where hackers stole 8.59 million B2 tokens, worth around $3.86 million.</p><p class="wp-block-paragraph">The <a href="https://x.com/Crypto_Jargon/status/2080122731887264103" rel="noopener noreferrer nofollow">attacker immediately</a> sold the stolen B2 tokens for 5,409 BNB, worth about $3.01 million. The funds were then bridged to Ethereum, converted into ETH and USDT, and later moved through NEAR Intents and HOT Protocol to make tracking harder.</p><p class="wp-block-paragraph">Security teams continue to monitor the wallet as the investigation remains active.</p><h2 id="h-veruscoin-hit-again-as-old-bridge-bug-returns" class="wp-block-heading">VerusCoin Hit Again as Old Bridge Bug Returns</h2><p class="wp-block-paragraph">The VerusCoin Ethereum bridge suffered the third attack, losing $7.54 million worth of assets, including Ether (ETH), tokenized Bitcoin (tBTC), USDC, USDT, DAI, and several other tokens.</p><p class="wp-block-paragraph">According to <a href="https://x.com/SlowMist_Team/status/2080192064478724299" rel="noopener noreferrer nofollow">SlowMist</a>, the attack reused the same import path contract bug that hackers exploited during a separate $11.5 million hack in May 2026. The weakness allowed the attacker to trigger unbacked payouts, meaning the bridge released assets without checking whether enough funds actually backed the transactions.</p><p class="wp-block-paragraph">After draining the bridge, the attacker converted the stolen assets into 3,916 ETH, worth about $7.5 million, before sending the funds to Tornado Cash, making recovery much more difficult.</p>

Three Crypto Bridge Hacks in DeFi Vanish $35.6M in One Day!

Table of Contents

CoinPedia News

Other articles published on Jul 23, 2026

What is BlackRock's BUIDL Fund on Avalanche AVAX?

Which Crypto Companies and Protocols Make The Most Money?

REAL Joins Blockchain for Europe to Shape EU Tokenisation Rules

Insights from CoinGecko's Q2 Crypto Report

Will Robinhood Chain Push ETH's Price to All Time Highs?

Grayscale Picks Its Most Promising Tokenization Blockchains

Join our free newsletter for daily crypto updates!