Three separate crypto protocol exploits within 24 hours have resulted in over $35 million in losses, with security firms noting technical similarities between two attacks on the Verus bridge. The incidents affected AFX Trade, BSquaredNetwork, and Verus, raising concerns about bridge security and audit practices.
On July 22, on-chain security firm PeckShieldAlert detected an attack on Arbitrum-based protocol AFX, with estimated losses of about $24.15 million USDC. The exploiter bridged the stolen funds from Arbitrum to Ethereum and swapped them for 12,467.5 ETH.
Less than an hour later, PeckShieldAlert reported that attackers drained BSquaredNetwork of $8.59 B2 tokens on BNB Chain, resulting in approximately $3.86 million in losses. The hackers swapped the tokens for over 5,000 WBNB, converted them into 1,128 ETH, and bridged the funds out using NEAR Intents, with B2’s price dropping over 15% afterward.
Blockchain security firm Lookonchain also alerted the public to a third incident affecting Ethereum-based cross-chain bridge Verus protocol, where exploiters made off with $7.55 million. This latest exploit comes roughly two months after Verus lost approximately $11.58 million in a separate incident.
Blockaid stated that the July attack seems related to the previous exploit, describing both as involving the same bridge contract, same entry path, and same bug class. Meanwhile, Steven Goldfeder, a contributor at Arbitrum, confirmed that the compromised bridge was operated independently by AFX and was not one of its native bridges.
On-chain security expert Taylor Monahan questioned why the AFX bridge had $24 million on it, revealing “terrifying” details after reviewing a recently published audit. According to her, the protocol had almost no test coverage, several issues flagged by auditors were acknowledged but never fixed, and the auditors allegedly could not fully review the code because they received only parts of it.
“Honestly, they seem like a super chill team. Ah yeah it’s probably fine we’ll just wait it out and then manually send if we need to,” she wrote. Monahan explained that the biggest red flags were what the technical vulnerabilities revealed about the team’s approach to security, suggesting a culture that did not prioritize it.
