H2 2026 July Bridge Hack Wave — Seven Attacks, $M+ Lost
Summary
In July 2026, at least seven cross-chain bridge protocols were exploited in a concentrated wave of attacks, collectively losing over $57 million in user and protocol funds. The incidents spanned Arbitrum, Ethereum, Solana, BNB Chain, Cardano, and Bitcoin-adjacent infrastructure, and were characterized by a shift toward non-code-level attack vectors including compromised signing keys, off-chain validator compromise, and replay/signature-encoding flaws. The cluster drew significant industry attention and raised systemic concerns about bridge security architecture.
Connected Entities
1 entities- + 1 more
Timeline(14 events)
2026-06-22
Taiko bridge exploited for $1.7M via forged message proof enabled by leaked SGX signing key; block production halted.
CoinDesk2026-07-02
Taiko reopens its Ethereum L2 bridge after 10-day pause; all affected users reimbursed following independent security review.
CoinDesk2026-07-08
Funds recovered from Verus May 2026 hack redeposited into the Verus-Ethereum bridge — later drained again on July 23.
CoinDesk2026-07-15
TeleSwap Bitcoin hot wallet begins showing suspicious outflows totaling over $735,000; transaction processing silently halts with no public disclosure.
Protos2026-07-17
Across Protocol Solana relayer exploited for $3.35–$4.5M via forged deposit events using missing Anchor discriminator verification; 1,627 attacker wallets deployed; no user funds lost.
CryptoTimes2026-07-20
Allbridge Core Solana pool exploited for $1.65M via flash loan price manipulation of USDC/USDT pool ratio; protocol paused.
TechTimes2026-07-21
Wanchain Cardano–BNB Chain bridge exploited for $10–13M (515M NIGHT tokens) via non-injective signed-message encoding flaw; NIGHT token crashes 30%+.
CryptoTimes2026-07-21
ZachXBT publicly discloses TeleSwap exploit five days after the fact; five days had elapsed with no communication from TeleSwap.
Protos2026-07-22
AFX Trade Arbitrum bridge drained of $24.15M USDC at 21:30 UTC via compromised validator private keys (5 of 7 validators); funds converted to ~12,467 ETH.
CoinDesk2026-07-23
B2 Network staking contract exploited for $3.86M via unauthorized upgrade authority takeover; 8.59M B2 tokens drained and converted to WBNB.
Metaverse Post2026-07-23
Verus-Ethereum bridge exploited a second time for $7.54M at 03:45 UTC via the same unpatched VerusProof verification flaw from May; proceeds laundered via Tornado Cash.
CoinDesk2026-07-23
Three protocols (AFX Trade, B2 Network, Verus) lose over $35M in a single day; described by analysts as peak of the July bridge hack wave.
CoinPedia2026-07-26
Garden Finance solver database breached for $450K across four chains; Blockaid raises alarm at 9:30 PM UTC; Garden halts app and engages security partners.
CoinTelegraph2026-07-31
Wanchain sets August 6, 2026 deadline for Cardano bridge hacker to return 90% of stolen NIGHT tokens in exchange for 10% white-hat bounty and no civil action.
CryptoTimesDecision Log
- #1publish⛓ pending8/7/2026, 12:05:00 AMhash: zS2xGp28n3pvVdFQemheUXBzJe2E8oQQG4FqY7qXqCe
28 of 30 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/7/2026, 12:04:48 AM
last updated: 8/7/2026, 4:14:43 AM
avoid.net — verified advice for a post-truth world