Three separate crypto bridge hacks wiped out more than $35.6 million in a single day. The attacks hit AFX Trade, BSquared, and VerusCoin, exposing serious security flaws across the DeFi sector. The attackers have already moved most of the stolen funds.
Blockchain investigators say each exploit followed a very different attack method, raising fresh concerns over bridge security.
AFX Bridge Loses $24.2 Million
The biggest hack hit AFX’s bridge on Arbitrum, where attackers stole 24.15 million USDC, worth about $24.2 million.
According to blockchain security firm Blockaid, the bridge approved the withdrawal using five signatures from its seven-validator system. This suggests the attackers may have gained access to validator keys or the bridge’s backend system.
After stealing the funds, the hacker quickly moved the USDC from Arbitrum to Ethereum.
In response to this, the AFX team said it is working with the Arbitrum team and security firms to investigate the exploit and trace the stolen funds.
BSquared Loses Nearly $3.9 Million in B2 Token Hack
The second attack targeted the BSquared Network, where hackers stole 8.59 million B2 tokens, worth around $3.86 million.
The attacker immediately sold the stolen B2 tokens for 5,409 BNB, worth about $3.01 million. The funds were then bridged to Ethereum, converted into ETH and USDT, and later moved through NEAR Intents and HOT Protocol to make tracking harder.
Security teams continue to monitor the wallet as the investigation remains active.
VerusCoin Hit Again as Old Bridge Bug Returns
The VerusCoin Ethereum bridge suffered the third attack, losing $7.54 million worth of assets, including Ether (ETH), tokenized Bitcoin (tBTC), USDC, USDT, DAI, and several other tokens.
According to SlowMist, the attack reused the same import path contract bug that hackers exploited during a separate $11.5 million hack in May 2026. The weakness allowed the attacker to trigger unbacked payouts, meaning the bridge released assets without checking whether enough funds actually backed the transactions.
After draining the bridge, the attacker converted the stolen assets into 3,916 ETH, worth about $7.5 million, before sending the funds to Tornado Cash, making recovery much more difficult.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
