The largest loss was recorded by AFX Trade, a perpetual futures platform operating through an independently managed bridge on Arbitrum. Attackers removed about $24.15 million in USDC before transferring the assets from Arbitrum to Ethereum and exchanging them for roughly 12,467 ether.
B² Network, a Bitcoin scaling project, suffered a separate loss of about $3.86 million after an attacker gained unauthorised access to the upgrade authority controlling its token-staking contract. The intruder generated or obtained about 8.59 million B2 tokens, sold them through decentralised markets and moved the proceeds across several networks.
B² suspended its staking service after detecting the breach and said affected users would be fully compensated. The stolen B2 tokens were converted into more than 5,000 wrapped BNB, exchanged for about 1,128 ether and transferred using a cross-chain transaction system. The B2 token fell by more than 15 per cent as traders responded to the sudden increase in supply and uncertainty surrounding the contract.
Verus Protocol’s Ethereum bridge was also drained of approximately $7.54 million in ether, tokenised bitcoin and stablecoins. The assets included USDC, USDT, EURC, Maker and tokenised savings products held within the bridge’s reserves.
The Verus attacker used the bridge’s import function to authorise Ethereum-side payments that were not backed by equivalent funds deposited on the Verus blockchain. The contract accepted the cross-chain message and released genuine assets even though the underlying claim carried little or no value.
The incident was especially damaging because the same bridge contract, transaction path and category of validation failure were exploited in May. That attack caused an estimated loss of $11.58 million after a manipulated import message bypassed checks designed to confirm the value committed on the source network.
Most of the assets taken in May were returned after negotiations over a bounty. Verus placed recovered funds back into the bridge on July 8, but the contract remained exposed to a comparable method of attack. The renewed drain two weeks later raised questions about whether the bridge had undergone adequate testing and remediation before liquidity was restored.
Verus held close to $100 million in total value locked at the beginning of 2025. The amount had fallen to about $9 million by Thursday, reflecting withdrawals, earlier security losses and reduced confidence in the protocol.
The three attacks did not compromise Bitcoin, Ethereum or the cryptographic systems securing their blockchains. Instead, the losses arose from weaknesses in the infrastructure built around them, including bridge logic, private keys, upgrade permissions and validation processes.
Cross-chain bridges allow users to transfer value between otherwise incompatible blockchain networks. They normally lock an asset on one network and issue a corresponding token or claim on another. Their security therefore depends on accurately confirming that every issued token is backed by funds held elsewhere.
A flaw in that confirmation process can allow an attacker to create an apparently valid message and withdraw real assets without making the required deposit. Compromised administrative credentials present a different danger, as control over an upgrade key can permit an attacker to alter contract behaviour without defeating its original code.
Questions have also emerged over the controls used by AFX Trade. The affected bridge was not part of Arbitrum’s native bridging infrastructure and was operated independently by the platform. Arbitrum contributors said the underlying network and its official bridges were not compromised.
Security specialists reviewing an earlier audit of the AFX bridge identified limited test coverage and unresolved issues that had been acknowledged during the assessment. Parts of the code were also unavailable for a complete review, restricting the auditors’ ability to examine the entire system before funds were deposited.
The attacks extend a difficult year for decentralised finance infrastructure. Cross-chain bridges have lost more than $2.8 billion through exploits over their operating history, accounting for a substantial share of assets stolen from blockchain applications.
Large bridge failures have repeatedly involved mechanisms outside the core blockchain. Earlier cases included stolen validator credentials, forged transaction messages, faulty proof verification and administrative keys controlled by too few individuals.
Arabian Post – Crypto News Network
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
