Three cross-chain bridge attacks broke out on the same day, with a total loss of more than US$35.6 million.
Within one day, three independent cryptographic cross-chain bridge attacks caused a total loss of more than US$35.6 million. The projects that were attacked were AFX Trade, BSquared and VerusCoin, exposing serious security vulnerabilities in the DeFi field. The attackers have moved most of the stolen funds.
Blockchain security investigators pointed out that each attack used a completely different approach, further raising new concerns about the security of cross-chain bridges.
AFX Bridge lost US$24.2 million
The most costly attack occurred on the AFX Bridge on Arbitrum. The attackers stole 24.15 million USDC units worth approximately $24.2 million.
According to blockchain security company Blockaid, the bridge approved the withdrawal using only five signatures in the seven-verifier system, indicating that the attacker may have obtained the verifier key or the bridge's backend system access.
Blockaid detected an exploit against the Arbitrum protocol @AFX_XYZ on July 22, 2026 at 21:30 (UTC). The attack specifically targets cross-chain bridges operated by AFX. As of now, approximately 24.15 million USDCs have been stolen from the agreement. Our team is working closely with relevant parties to investigate the matter and track down the stolen funds.
After the theft, hackers quickly transferred USDC from Arbitrum to Ethereum. In response, the AFX team said it is working with the Arbitrum team and security companies to investigate the cause of the vulnerability and track down stolen funds.
BSquared was attacked by B2 tokens, losing nearly US$3.9 million
The second attack targeted the BSquared Network, where hackers stole 8.59 million B2 tokens worth approximately US$3.86 million. The attacker immediately exchanged the stolen B2 tokens for 5409 BNB (approximately US$3.01 million), then bridged the funds to Ethereum, exchanged them for ETH and USDT, and then transferred them through NEAR Intention and HOT Protocol to increase the difficulty of tracking. The security team is still monitoring the relevant wallet addresses and the investigation is still in progress.
VerusCoin was attacked again, old bridge vulnerabilities reappeared
The third attack occurred on VerusCoin's Ethereum Bridge, resulting in the theft of US$7.54 million worth of assets, including various tokens such as Ethereum (ETH), tokenized Bitcoin (tBTC), USDC, USDT, and DAI.
According to analysis by the Slow Fog Security Team, this attack exploited the same import path contract vulnerability in a previous $11.5 million hacker attack in May 2026. The vulnerability allows attackers to trigger unsecured payments, in which bridges release assets without verifying that the transaction is backed by sufficient funds.
After stealing the assets in the bridge, the attacker exchanged the stolen assets for 3916 ETH (approximately US$7.5 million) and then sent the funds to Tornado Cash, making it extremely difficult to recover the funds.

Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BNB
ETH
B2