Two Ethereum bridges lose $31.7M within hours as third protocol halts staking

AFX and the Verus-Ethereum bridge suffered $31.69 million in combined losses within hours of each other, while B² Network separately suspended token staking after unauthorized access to a contract upgrade authority.

Blockaid said it detected the AFX exploit at 21:30 UTC on July 22. An Arbitrum transaction recorded 24.15 million USDC leaving the bridge operated by AFX, a decentralized trading protocol on Arbitrum.

AFX suspended its USDC custody bridge and said the incident was isolated from its trading infrastructure, mainnet, and the Arbitrum network. The affected component was a third-party bridge, not Arbitrum's native bridge.

In preliminary findings published July 24 , AFX attributed the incident to coordinated social engineering and infrastructure compromise. The protocol said access appeared to begin in a development environment before escalating into internal build infrastructure and validator systems.

AFX said it was verifying balances, pursuing fund recovery and preparing remediation. As of July 24, it had not announced a completed return of funds or a finalized compensation plan.

Hours after the AFX incident, an Ethereum transaction showed the Verus bridge releasing 1,137.4528 ETH and seven token transfers. Blockaid valued the unbacked payouts at $7.54 million.

SlowMist's analysis said the bridge approved eight withdrawals without proving that matching assets backed them. The firm linked the failure to the same broad cross-chain import-validation class as a May exploit, but said the two attacks used different mechanics.

B²'s incident was not disclosed as a bridge exploit. The network said there was unauthorized access to its staking contract's upgrade authority. B² suspended normal staking during security reviews, said the issue was contained, and promised full compensation to affected users. It had not documented completed restitution as of July 24.

B² also offered a manual exit: users could request unstaking through its official Discord, with ownership-verified requests to be processed within one business day. The network did not state a loss amount, so its incident is excluded from the $31.69 million bridge-loss total. Until normal staking resumes, that manual review is the route B² offered users seeking to withdraw staked tokens.

The three episodes exposed different controls outside base-chain consensus. AFX's custody and validator infrastructure, Verus's bridge-accounting checks, and B²'s staking-contract upgrade authority each became the point where normal access failed.

For users, the test is whether recovery plans return funds, whether cross-chain validation verifies economic backing and whether upgrade authority is protected without making emergency exits depend on manual intervention.

Also known as "Akiba," Liam Wright is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate. He believes that decentralized technology has the potential to make widespread positive change.

CryptoSlate may use AI tools to support research, editing, and production workflows. Published articles remain editorially reviewed by our team. Read our full AI usage disclaimer .

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article. Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers .