Overview
- A cluster of exploits during July 22–23 targeted third‑party bridges and cross‑chain systems, with combined reported losses exceeding $35 million across AFX Trade, Verus and B² Network.
- AFX Trade’s custody bridge lost about $24.15 million in USDC after attackers used enough hot‑validator signatures to meet the quorum, then moved the funds to Ethereum and swapped them for roughly 12,467 ETH.
- The Verus Ethereum bridge was drained for about $7.54 million on July 23 through the bridge’s import path, and security firms say the transaction reused the same contract entry path and bug class seen in a May exploit.
- On‑chain trackers show attackers rapidly converted stolen tokens into ETH and routed large batches into privacy services such as Tornado Cash, a tactic that narrows options for on‑chain recovery or exchange freezes.
- Protocols halted bridge operations, engaged security firms and offered recovery bounties such as AFX’s public 70/30 return proposal, highlighting persistent operational risks in validator key management and cross‑chain validation that could push further safety changes and user withdrawals.