$35 million vanished from crypto 'bridges' in hours — a beginner's guide to the weakest link

Over roughly six hours, attackers drained more than $35 million from at least three crypto bridges and cross-chain tools: AFX Trade on Arbitrum lost about $24 million, the Verus-Ethereum bridge about $7.5 million, and Bitcoin scaling network B² about $3.9 million. None of them was beaten by cracking the underlying cryptography. In each case, someone lost control of a key or an administrative permission.

A bridge is the plumbing that lets assets move between two blockchains that otherwise can't talk to each other. It locks real tokens on one side and issues claims against them on the other, so its safety depends entirely on correctly checking that every withdrawal is backed by assets genuinely locked on the far chain. When that check can be tricked — or the keys that authorize withdrawals fall into the wrong hands — the bridge can pay out real money against nothing.

AFX shows the second failure mode. Security firms said an attacker obtained the bridge's validator signing keys, and five signatures were enough to clear the approval threshold, so the contract released $24 million in USDC exactly as designed. The funds were moved to Ethereum and swapped for about 12,467 ETH. Arbitrum's co-founder stressed that the network's own bridge was not touched — this was a contained failure of a third-party protocol built on top of it. AFX later offered the attacker a deal: return 70% and keep the rest as a “white hat bounty.”

Verus shows how these wounds reopen. The same flaw had already drained about $11.5 million in May; after the attacker returned funds, Verus redeposited the recovered money into the same bridge on July 8, and it was emptied again two weeks later. Its total value locked has fallen from close to $100 million at the start of 2025 to roughly $9 million. At B², the attacker seized the “upgrade authority” of a staking contract — the administrative power that controls how the contract behaves — which is effectively the keys to rewrite the rules.

For a beginner, the pattern of 2026 is the real lesson: the thefts rarely break the math, they exploit the keys and permissions around it. DeFi has now lost more than $840 million to hacks this year. Bridges concentrate a lot of value in one place and keep turning up as a weak point, so be cautious about leaving funds parked in bridge or cross-chain products — and remember that “the blockchain itself wasn't hacked” does not mean the money sitting on it was safe.