Two Ethereum bridges lost about $31.69 million combined within hours on July 22–23, while a third project suspended staking after an unauthorized contract upgrade — three separate incidents that exposed different control failures across the crypto infrastructure layer.
AFX drained via social engineering
The AFX bridge on Arbitrum saw 24.15 million USDC leave at around 21:30 UTC on July 22. AFX attributed the exploit to coordinated social engineering and infrastructure compromise that started in a development environment. The exchange suspended its USDC custody bridge and stressed the incident was isolated to a third-party bridge — not Arbitrum's native bridge or AFX's own trading infrastructure. As of July 24, AFX had not announced completed fund recovery or a finalized compensation plan.
Verus-Ethereum bridge hit by validation flaw
Losses on the Verus-Ethereum bridge amounted to about $7.54 million, including 1,137.4528 ETH and seven token transfers. Security firm SlowMist linked the failure to a cross-chain import-validation class issue — similar to a May 2026 exploit but with different mechanics. The problem allowed unbacked payouts, meaning the bridge released funds without properly verifying the corresponding deposits on the other side.
B² Network halts staking after contract tampering
The B² Network, a Bitcoin layer-2 project, suspended staking after unauthorized access to its staking contract's upgrade authority. No loss amount has been disclosed. The team promised full compensation to affected users and offered a manual exit via Discord with ownership verification — turnaround time pegged at one business day.
Three incidents, three different failure modes
The week's events illustrate how varied the attack surface is. AFX fell to compromised validator infrastructure and human engineering; Verus suffered a logic gap in its bridge-accounting checks; B² saw its staking contract's upgrade authority taken over. None of the three projects have announced complete fund recovery. The next concrete step: users of B² Network can expect manual exits within a business day, while AFX and Verus have yet to specify timelines for compensation or forensic reports.
