Two separate bridge exploits drained $31.6 million in cryptocurrency within just seven hours on July 23, but the root cause wasn't a flaw in the underlying code,it was compromised operational security in the bridge infrastructure itself. The back-to-back attacks targeted AFX, a decentralized perpetual exchange on Arbitrum, and the Verus Ethereum Bridge, highlighting a critical vulnerability in how bridges manage their signing infrastructure rather than their smart contracts.

What Happened in the AFX and Verus Bridge Exploits?

According to security firm Blockaid, AFX lost $24.15 million when attackers exploited one of its cross-chain bridges on Wednesday, July 23 at 9:30 p.m. UTC. Hours later, the same firm detected a separate exploit targeting the Verus Ethereum Bridge that resulted in approximately $7.5 million in stolen cryptocurrency, including Ether, tBTC (a Bitcoin-backed token), USDC, USDt, EURC, MKR, and scrvUSD.

The Verus attack appeared strikingly similar to a previous incident in May that drained $11.58 million from the same bridge, using the same attack method but a different attacker wallet. This pattern suggests a recurring vulnerability in how the Verus bridge processes asset transfers.

Why Weren't These Smart Contract Vulnerabilities?

The critical distinction in these exploits lies in where the security failure occurred. Rather than exploiting a logic bug in the bridge's smart contract code, attackers compromised the validator keys that authorize transactions across the bridge. Validators are essentially gatekeepers that verify and sign off on fund transfers between blockchains.

"This appears to have been an operational security incident rather than a smart contract vulnerability. The unauthorized withdrawal carried genuine validator signatures, meaning the bridge's onchain verification behaved exactly as designed rather than being bypassed," said Ido Ben-Natan, co-founder and CEO of Blockaid.

Ido Ben-Natan, Co-founder and CEO, Blockaid

According to Ben-Natan, the required validator quorum (the minimum number of signatures needed to approve a transaction) had been satisfied using authentic signatures, indicating the compromise occurred in the bridge's offchain signing infrastructure rather than in the bridge contract itself. In simpler terms, the attackers obtained the actual keys used to sign transactions, rather than tricking the system into accepting invalid ones.

SunSec, founder of the Web3 security community DeFiHackLabs, reached the same conclusion, noting that evidence pointed to compromised keys rather than a smart contract logic bug. Blockaid's assessment confirmed that five hot validator keys had been compromised in the AFX incident.

How to Protect Yourself From Bridge Exploits

• Monitor Official Channels: Follow announcements from the protocols and networks you use, such as Arbitrum and AFX, to stay informed about security incidents and recovery efforts in real time.
• Diversify Across Platforms: Rather than concentrating assets in a single bridge or protocol, spread your holdings across multiple audited platforms to reduce exposure if one is compromised.
• Verify Audit History: Before depositing funds into a DeFi protocol or bridge, check whether it has undergone third-party security audits and review the audit reports for any identified risks.

Offchain Labs co-founder Stephen Goldfeder clarified that the Arbitrum network's native bridge was not compromised, meaning the exploit was isolated to AFX's third-party bridge infrastructure. This distinction is important because it means other protocols and users on Arbitrum were not directly at risk from this specific incident.

Why Bridges Remain a Persistent Target

The rapid succession of these two exploits underscores a broader pattern in the cryptocurrency ecosystem. Bridges, which hold large pools of assets and move funds between separate blockchains, have become prime targets for attackers because they concentrate significant value in a single point of failure.

"Another bridge, another exploit. Bridges will always be a weak link, until security is upgraded," observed TheCrypticWolf, an onchain investigator.

TheCrypticWolf, Onchain Investigator

The AFX incident affected liquidity providers and users who had deposited assets into the protocol, representing a significant financial loss. While the broader Arbitrum ecosystem remained secure, such incidents can erode user confidence in decentralized finance platforms and highlight the critical need for rigorous security practices.

The distinction between smart contract vulnerabilities and operational security failures is crucial for the DeFi ecosystem. Smart contract audits can identify code flaws, but they cannot prevent attackers from stealing the private keys that authorize transactions. This means bridge operators must implement additional layers of security, such as hardware wallets, multi-signature schemes, and strict access controls on validator keys.

As investigations continue into both exploits, the crypto community is awaiting further details on how the validator keys were compromised and what recovery efforts may be possible. The incidents serve as a stark reminder that even well-designed protocols can face significant risks if their operational infrastructure is not adequately protected.