Three protocols hit in rapid succession

CoinDesk reported on July 23 that attackers drained more than $35 million from multiple protocols in the space of about six hours. The largest victim was AFX, an Arbitrum-based protocol, which lost $24.15 million after its bridge keys were compromised, enabling unauthorized access. According to Crypto Briefing, the AFX losses were approximately $24.15 million in USDC.

The Verus Ethereum bridge lost $7.54 million, and B² Network lost $3.86 million after an attacker gained unauthorized access to its token staking contract's upgrade authority, giving direct control over contract behavior without exploiting any code bug.

The Verus bridge was drained twice in three months

The Verus incident stands out because it was a repeat. The attacker exploited a logic flaw in the same bridge contract that was hit in a May 2026 hack that took $11.5 million.

Security firm Blockaid explained: "An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves."

Worse still, CoinDesk reported that the funds recovered after the May hack had been redeposited on July 8, only to be drained again roughly two weeks later through the same contract path.

No cryptography was broken

The common thread across all three attacks is telling: none involved broken cryptography. Every loss stemmed from compromised keys, hijacked administrative permissions, or code logic flaws.

Security firms tracking the incidents included Blockaid, PeckShield and Lookonchain. BeInCrypto put the combined total at $35.5 million across the three incidents and reported that AFX was negotiating with the attacker while the Verus and B² investigations were ongoing.

Why this matters for the market

Cross-chain bridges and admin-key management remain crypto's weakest link. The attacks targeted the infrastructure around blockchains, not the blockchains themselves, and every one of them came down to operational security failures rather than cryptographic breaks.

The Verus re-drain in particular highlights how unpatched bridge logic invites repeat attacks. Recovered funds were put back into a contract with a known exploited path and stolen again within two weeks.

A blow to sentiment in a fragile week

The exploits landed during an already nervous stretch for the market, with bitcoin consolidating in the $65,000 to $66,000 range and traders watching the Clarity Act negotiations in Washington. Crypto Briefing reported the breaches dented sentiment, with market pricing suggesting a decreased likelihood of bitcoin reaching $82,500 in July.

For users, the takeaway is familiar but worth repeating: the security of a protocol is only as strong as its key management and admin controls, and bridges continue to be the highest-risk part of the crypto stack.