The cryptocurrency world is reeling from a massive security breach after hackers stole over $31.6 million in two unrelated cross-chain bridge exploits. Occurring just seven hours apart, the attacks targeted bridges operated by the decentralized perpetual exchange AFX and the Verus Protocol.
These back-to-back incidents serve as a harsh reminder of the ongoing security risks associated with cross-chain bridges. Because these bridges hold vast pools of assets to facilitate the transfer of funds between different blockchains, they remain a highly lucrative target for cybercriminals. As on-chain investigator TheCrypticWolf pointed out on X, bridges will continue to be a weak link in the crypto ecosystem until industry-wide security standards see a major upgrade.
AFX Protocol Loses $24.15 Million to Compromised Keys
The first attack took place late Wednesday when blockchain security firm Blockaid detected a major exploit targeting a cross-chain bridge operated by AFX, a decentralized exchange built on the Arbitrum network. In this incident alone, the protocol lost an estimated $24.15 million.
Stephen Goldfeder, co-founder of Offchain Labs, quickly stepped in to clarify the scope of the situation. He confirmed that while a third-party protocol on Arbitrum was indeed hacked, the Arbitrum native bridge itself remained entirely secure and was not compromised in any way.
Further investigations suggest the massive breach was caused by stolen credentials rather than a flaw in the actual code. SunSec, founder of DeFiHackLabs, and Ido Ben-Natan, CEO of Blockaid, both noted that the evidence strongly points to a compromise of five hot validator keys. According to Ben-Natan, this was an operational security failure. Because the attackers had genuine validator signatures, the bridge’s smart contract verified the unauthorized withdrawal exactly as it was programmed to do. The vulnerability wasn’t in the on-chain contract, but rather in the off-chain signing infrastructure.
Verus Ethereum Bridge Drained of $7.5 Million
Just hours after the AFX incident, a second, unrelated attack hit the Verus Ethereum bridge. This exploit drained approximately $7.5 million in various cryptocurrencies, including Ether, USDC, USDT, and Bitcoin-backed tBTC, straight from the bridge’s reserve pools.
According to Blockaid, this latest breach looks strikingly similar to a previous attack on the Verus Ethereum bridge back in May, which resulted in an $11.58 million loss. While the attacker wallet used this time was different, the underlying method was identical. The hacker manipulated the bridge’s import path to trigger payouts on the Ethereum side that were completely unbacked by actual deposits.
These twin attacks highlight a critical and urgent need for enhanced operational security and stronger infrastructure across the decentralized finance space, especially as these cross-chain bridges continue to handle millions of dollars in daily transfer volume.
