Three separate decentralized finance (DeFi) exploits struck within hours on July 23, draining approximately $35.55 million in combined losses and exposing a troubling pattern: known vulnerabilities in cross-chain bridges remain unfixed even after previous attacks. The incidents highlight why bridges, which allow users to move assets between different blockchains, continue to be the weakest link in cryptocurrency security despite industry-wide improvements over the past two years.

What Happened in the July 23 Exploits?

The day began with AFX Trade, a decentralized trading protocol on the Arbitrum network, losing approximately $24.15 million in USDC (a stablecoin pegged to the US dollar) through a bridge-related exploit. Blockchain security firm Blockaid detected the attack at 21:30 UTC on July 22 and confirmed that the vulnerability was specific to a bridge operated by AFX Trade itself, not Arbitrum's core infrastructure. The attacker quickly moved the stolen funds to the Ethereum mainnet and converted them into approximately 12,467 ETH (Ethereum's native token), worth around $24 million at the time.

Hours later, the Verus Ethereum Bridge suffered a second exploit, draining $7.54 million in assets including ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. What made this incident particularly alarming was that it exploited the same vulnerability that had hit the same bridge in May 2026, when attackers stole $11.58 million. Blockaid confirmed that both attacks targeted the same bridge contract through the same import path, suggesting the original flaw was never fully remediated.

A third exploit affecting B² Network added another $3.86 million to the day's losses, bringing the total to $35.55 million across all three incidents.

Why Did the Verus Bridge Get Hacked Twice Using the Same Flaw?

The Verus incident is particularly troubling because it reveals a fundamental failure in incident response and remediation. According to security firm Halborn, the vulnerability was not a cryptographic failure but rather a missing validation check in the bridge's code. The bridge verified signatures and cryptographic proofs correctly, but it never confirmed that the value committed on the Verus blockchain matched the actual payout released on Ethereum.

"The bridge failed to validate that the source value matched the destination payout, allowing an attacker to spend only minimal fees while withdrawing millions," explained Mir Jalal, a researcher at Merkle Science.

Mir Jalal, Merkle Science

Merkle Science identified the problem as stemming from approximately 10 lines of missing Solidity validation code in the checkCCEValues function. This meant that a transaction worth even 1 cent could pass all of the bridge's signature and Merkle-proof requirements before the Ethereum smart contract executed and released assets worth millions of dollars. The May attacker later returned 4,052.4 ETH (worth about $8.5 million at the time) after the project offered settlement terms, but kept 1,350 ETH as a bounty.

The fact that the same vulnerability was exploited again in July suggests that either the fix was incomplete or the project did not prioritize remediation after the May incident. Blockaid noted that the July attack "appears related to the previous Verus Ethereum Bridge incident in May 2026," involving the same contract, entry path, and bug class, though the exact technical cause remained under investigation at the time of disclosure.

Blockaid

How Do Cross-Chain Bridges Work, and Why Are They Vulnerable?

Cross-chain bridges are protocols that allow users to lock assets on one blockchain and receive equivalent tokens on another blockchain. They serve as critical infrastructure for the multi-chain cryptocurrency ecosystem, enabling users to move value between networks like Ethereum, Arbitrum, and others. However, bridges must manage extremely large shared liquidity pools and verify transactions across separate blockchains, making them complex targets for attackers.

The core challenge is that bridges must validate events on one chain while controlling assets held in reserves on another. Errors in message validation, contract logic, or access controls can allow a transaction to release assets without a valid matching transfer on the source side. This is exactly what happened with both the AFX Trade and Verus exploits.

Steps to Understand Bridge Security Risks

• Validation Gaps: Bridges must verify that the value committed on the source blockchain matches the payout released on the destination blockchain. Missing this check allows attackers to withdraw far more than they deposited.
• Import Path Vulnerabilities: Both the AFX Trade and Verus exploits targeted the bridge's import mechanism, which processes cross-chain transfers. Flaws in this path can be weaponized repeatedly if not fully addressed.
• Shared Liquidity Pools: Bridges hold massive reserves of locked assets. A single validation error can drain millions because the attacker can withdraw from the entire pool, not just their own deposit.

Is Bridge Security Actually Improving?

The July incidents come at a time when the broader cryptocurrency industry has made measurable progress on bridge security. According to data from Immunefi, bridge-related losses represented 73 percent of all DeFi hacks in 2022, but that figure dropped to just 3 percent by 2025. Additionally, TRM Labs reported 207 cybersecurity attacks on crypto in the first half of 2026, the highest in any six-month period, yet total losses fell from $2.3 billion in 2025 to $972 million in the current period.

However, the Verus repeat exploit demonstrates that statistical improvements mask a critical problem: unresolved vulnerabilities in existing bridges remain exploitable. Security audits and improved bridge designs have raised the overall bar, but projects that fail to fully remediate known flaws create dangerous exceptions. Steven Goldfeder, CEO of Offchain Labs (the company behind Arbitrum), emphasized that Arbitrum's native bridge was not affected by the AFX Trade exploit, confirming that the vulnerability was specific to a third-party protocol's implementation.

The incidents also echo earlier bridge disasters. Merkle Science noted that the same type of validation failure was responsible for the Wormhole and Nomad bridge exploits in 2022, suggesting that the cryptocurrency industry has not fully learned from past mistakes.

What Happens to Stolen Funds After a Bridge Exploit?

In the AFX Trade case, the attacker moved the $24.15 million in stolen USDC from Arbitrum to Ethereum and immediately converted it into ETH. This strategy complicates asset tracing and recovery because ETH is more liquid and harder to freeze than stablecoins. In contrast, the May Verus attacker eventually returned most of the stolen funds after the project negotiated settlement terms, though the July attacker's next moves remained unclear at the time of reporting.

Blockchain security firms like Blockaid and PeckShield can track stolen assets on-chain, but recovery depends on whether the attacker converts funds into less traceable cryptocurrencies, moves them through mixing services, or negotiates with the affected project. The speed of these conversions often determines whether recovery is possible.

What Should Users Know Right Now?

Merkle Science advised users to refrain from using the Verus bridge until the faulty validation was resolved and approved by an independent auditor. More broadly, the incidents underscore that bridge security is not a one-time fix but an ongoing process. Projects must conduct thorough post-mortems after exploits, implement complete remediation, and have fixes independently verified before resuming operations.

The July 23 exploits also serve as a reminder that even as the cryptocurrency industry improves its overall security posture, individual projects can lag behind. Users should monitor official announcements from bridge operators and security firms before moving significant amounts of value across chains. The fact that three major exploits occurred within 24 hours suggests that attackers are actively probing for vulnerabilities, making due diligence essential for anyone using cross-chain protocols.