B² Network (BSquared) — Bitcoin Layer-2 Staking Contract Exploit
Summary
On July 22, 2026, B² Network — a Bitcoin Layer-2 ZK rollup protocol — suffered a security incident in which an attacker allegedly exploited unauthorized access to the B2 token staking contract's upgrade authority and drained approximately 8.59 million B2 tokens valued at roughly $3.86 million. The stolen tokens were converted to BNB, bridged to Ethereum, and reportedly laundered through NEAR Intents and HOT Protocol toward Zcash. The team suspended staking, committed to full user compensation, and reportedly offered the attacker legal immunity in exchange for a partial refund. As of August 2026, no funds have been publicly confirmed as recovered.
Connected Entities
1 entitiesTimeline(11 events)
2024-01-01
B² Network announces successful seed-round fundraising from investors including HashKey Capital, OKX Ventures, IDG, KuCoin Ventures, and ABCDE. Exact date within January 2024 unconfirmed.
B² Network Official — Medium2025-01-01
According to post-exploit reporting by Metaverse Post, the wallet later used in the exploit had already been granted privileged upgrade authority over the staking contract by some point in 2025. The exact date within 2025 is unconfirmed.
Metaverse Post2025-06-30
B² Network reports over 140 million cumulative transactions on its B² Rollup Layer 2 and more than 600,000 users on its BTC-Fi platform Buzz.
CoinMarketCap AI — BSquared Network2026-07-22
Attacker allegedly exploits unauthorized access to the B2 staking contract's upgrade authority on BNB Chain and drains approximately 8.59 million B2 tokens ($3.86M at time of theft). Tokens are immediately sold for approximately 5,409 WBNB (~$3.01–$3.11M).
B² Network (X); Metaverse Post; Crypto Adventure2026-07-22
Stolen BNB proceeds bridged from BNB Chain to Ethereum and converted to ETH and USDT. Assets deposited into NEAR Intents and HOT Protocol, reportedly routed toward Zcash.
Metaverse Post; Crypto Adventure; cryip.co2026-07-22
B² Network publishes official statement on X confirming the incident, suspending B2 staking, and pledging full user compensation. Users directed to Discord support tickets for manual unstaking.
B² Network official X account2026-07-22
B2 token price declines approximately 15% on sell pressure from attacker liquidation. Attacker's average realized sale price approximately $0.35 against a pre-exploit price near $0.45, implying roughly $850,000 in slippage.
Crypto Adventure; CoinPedia; cryip.co2026-07-22
AFX Trade loses $24.15M in USDC via a separate Arbitrum bridge exploit attributed to compromised validator keys, occurring within the same approximately 24-hour window. Blockaid detects the attack at approximately 21:30 UTC.
Halborn; Crypto Briefing; Blockaid (via CryptoSlate)2026-07-23
B² Network reportedly sends on-chain message to attacker offering legal immunity in exchange for return of at least 10% of stolen funds (~$386,000) within 24 hours. Terms attributed to Metaverse Post; not confirmed in official X statement.
Metaverse Post2026-07-23
Verus Ethereum bridge loses approximately $7.54 million in mixed assets in a third exploit within the same 24-hour window. CoinDesk reports combined losses across all three incidents at approximately $35 million.
CoinDesk; CryptoSlate2026-08-18
As of investigation date, no public confirmation of fund recovery, attacker response to bounty offer, staking resumption, completed user compensation, or regulatory or law enforcement action.
AVOID.NET investigation (no confirming public source found)Decision Log
- #1publish⛓ pending8/18/2026, 5:05:11 PMhash: DHTPWeYi3Qhd29ZuZUv2hKa7xg4vaVycTcA1TdFL4R1E
9 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/18/2026, 5:05:00 PM
last updated: 8/19/2026, 2:07:16 AM
avoid.net — verified advice for a post-truth world