Security Alert
At least three cross-chain protocols lost more than $35 million in a six-hour span after separate attacks targeted bridge infrastructure, administrative controls, and contract validation logic.
The largest loss came from AFX, where an Arbitrum bridge was exploited for $24.15 million. The Verus-Ethereum Bridge lost $7.54 million after attackers reused the same vulnerability exploited earlier this year, while B² Network suffered a $3.86 million loss after attackers gained control of its staking contract’s upgrade authority.
Despite targeting different protocols, investigators found the attacks shared a common pattern. None broke blockchain encryption or consensus mechanisms. Instead, attackers exploited trusted components surrounding the protocols, including bridge verification logic, privileged administrative keys, and upgrade permissions.
???? Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum.
An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves.
More details in ????— Blockaid (@blockaid_) July 23, 2026
Intelligence Finding
The attacks reinforce a recurring weakness across cross-chain infrastructure: trusted control points remain the highest-value target. Whether through compromised upgrade authority or flawed bridge validation, attackers continue to bypass cryptographic security by exploiting protocol governance and operational controls. Verus being exploited twice through the same attack path also raises concerns over remediation standards after security incidents. As bridge infrastructure becomes increasingly interconnected, protecting administrative access and off-chain verification systems is becoming as critical as auditing smart contracts themselves.
