Crypto's bridges and cross-chain protocols are having a brutal day, capping an already punishing year.
At least three were drained in quick succession over a 6-hour period, for a combined total exceeding $35 million, according to blockchain data analyzed by CoinDesk and reported by security firms BlockAid and PeckShield.
The run of attacks shares a common thread that underscores the need to audit off-chain components, such as private keys, not just smart contract code.
None broke the underlying cryptography — each was either a logic flaw, where the code ran as written, but the rules still let money out, or a compromised key that handed an attacker control it should never have had.
The perpetuals exchange AFX lost about $24.15 million from a bridge it runs on Arbitrum. The Verus-Ethereum bridge was drained of $7.54 million, its second hack this year through the same flaw. And B², a Bitcoin scaling network, lost $3.86 million from its token staking contract.
The most damning was blockchain network Verus. Blockaid detected an exploit on the Verus-Ethereum bridge early Thursday that drained about $7.54 million in ether, tokenized bitcoin and a spread of stablecoins.
🚨 Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum.An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves.More details in 🧵
The firm flagged that the attack reused the same bridge contract and entry path as an earlier hack, exploiting an identical class of bug. CoinDesk reported that earlier incident, an $11.5 million loss, in May.
A bridge is a blockchain-based tool that enables assets to move between two networks that otherwise cannot interact. It holds real tokens on one side and issues claims against them on the other, and its safety depends entirely on correctly verifying that every withdrawal is genuinely backed by assets locked on the other chain.
The Verus flaw let an attacker trigger payouts on the Ethereum side that were never properly backed on the Verus side, so the bridge released real money against a claim worth almost nothing.
The attacker returned most of the funds in exchange for a bounty after the May attack. Verus then redeposited the recovered money into the same bridge on July 8, according to onchain records compiled by security researchers, and the bridge was drained again two weeks later.
The cost of that trust is visible in the protocol's own numbers. Verus held close to $100 million in total value locked at the start of 2025, according to DefiLlama. It holds about $9 million as of Thursday, a slow bleed punctuated by a fresh drop this week as the latest hack landed.
Source
This article is syndicated for educational reading. For the latest updates, visit the original publisher.
Read on coindesk.com
