July 2026 Bridge Hack Wave — Three Protocols, $35.6M, One Day
Summary
On July 22–23, 2026, three separate cross-chain bridge protocols — AFX Trade, B-Squared Network, and Verus — were exploited within approximately six hours of each other for a combined loss of roughly $35.6 million. The incidents contributed to a July 2026 monthly total of approximately $97 million in crypto security losses and are part of a record-setting H1 2026 in which total hack losses surpassed $1 billion across the industry. No single threat actor has been publicly attributed to all three attacks, though the clustering prompted security firm Blockaid to label the period 'Hackers Day.'
Connected Entities
1 entitiesTimeline(7 events)
2026-05-18
Verus-Ethereum bridge suffers its first exploit, losing approximately $11.5 million via the same import-path vulnerability later used in July. The attacker subsequently accepts a white-hat bounty and returns most of the funds.
Flagged Live: Attacker Flips $11.5M in Stolen Verus Assets to ETH Following Tornado Cash Setup — Bitcoin.com News2026-07-08
Verus team redeposits approximately $11.58 million of recovered funds into the Ethereum bridge. The underlying import-path vulnerability was not patched before redeployment.
Verus bridge hit by second exploit, flaw remains unfixed — Cryptopolitan2026-07-22
AFX Trade bridge exploited for $24.15 million in USDC after an attacker compromises five of seven validator signing keys. Funds bridged to Ethereum and converted to approximately 12,467 ETH.
Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk2026-07-22
B-Squared Network staking contract exploited for 8.59 million B2 tokens ($3.86 million) via unauthorized access to the upgrade authority. Attacker immediately converts to BNB and bridges to Ethereum.
B² Network Suffers $3.86M Exploit, Offers Attacker Legal Immunity For Partial Refund — Metaverse Post2026-07-23
Verus-Ethereum bridge exploited for $7.54 million using the same import-path vulnerability as May 2026. Stolen assets converted to approximately 3,916 ETH and sent to Tornado Cash.
New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid — The Block2026-07-23
AFX Trade publicly offers attacker a 30% bounty (~$7.2M) to return the remaining 70% of stolen funds. B-Squared offers legal immunity in exchange for return of at least 10%.
AFX Trade offers exploiter $7.2M bounty to return 70% of stolen funds — CryptoBriefing2026-07-29
Blockaid publishes H1 2026 report noting crypto hack losses exceeded $1.1 billion across a record number of incidents, with cross-chain bridge exploits among the leading attack vectors.
Crypto Hacks Cross $1.1B in Record H1 2026 Losses: Blockaid — CryptoTimesDecision Log
- #1publish⛓ pending8/13/2026, 5:17:48 PMhash: F9coVJSc9brXv8NTasR7EmDG8bCf4nPJULCGB5jRmb3r
26 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/13/2026, 5:17:38 PM
last updated: 8/13/2026, 9:01:05 PM
avoid.net — verified advice for a post-truth world