Two major cross-chain bridges suffered security breaches in July 2026, with attackers stealing over $31 million from AFX Trade and VerusCoin in separate but closely timed incidents. Blockchain security firm Blockaid identified and publicized both exploits as they were in progress, increasing concerns about ongoing vulnerabilities in the bridge infrastructure supporting decentralized finance (DeFi).
AFX Trade bridge hacked for $24 million on Arbitrum
Blockaid first detected an attack on the Arbitrum-based AFX Trade protocol at 21:30 UTC on July 22. The hacker managed to compromise five hot-validator signatures on AFX’s custody bridge, bypassing the required quorum and executing an unauthorized transfer of $24.15 million in USDC tokens.
Security teams revealed that the stolen USDC was moved to an Ethereum wallet, then swapped out for 12,467.5 ETH. PeckShieldAlert traced the movement of these funds, which remain in the address 0x6276…ebAC.
Blockaid stated it had identified a targeted exploit affecting a bridge operated by AFX on Arbitrum. The incident enabled an attacker to drain approximately $24.15 million in USDC from the protocol in a single operation.
AFX paused bridge operations as soon as the breach was discovered, clarifying that neither its core trading infrastructure nor the wider Arbitrum network was affected. Steven Goldfeder, representing the Arbitrum Foundation, separately confirmed that Arbitrum’s native bridge had not been compromised, attributing the unauthorized withdrawal to a third-party protocol integration.
AFX disclosed that all stolen funds are still located in the attacker’s wallet. Security firm SlowMist reported the wallet address to the Crypto Defense Alliance, an industry network tracking stolen digital assets, while Zellic, which previously audited the bridge’s code, joined the ongoing investigation.
AFX pledged to provide frequent updates as more facts are verified and as recovery efforts continue.
Mini dictionary: Arbitrum is a layer 2 scaling solution for Ethereum that aims to provide faster and cheaper transactions by processing them off the Ethereum main chain and then settling the results back onto the mainnet.
VerusCoin bridge loses $7.5 million in recurring exploit
Blockaid also flagged a breach in the VerusCoin Ethereum Bridge, resulting in a further loss of roughly $7.54 million. The attacker manipulated the bridge’s import mechanism to trigger payouts that lacked the necessary asset reserves, siphoning off multiple cryptocurrencies, including ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The stolen funds were transferred from the bridge contract to a wallet ending in C142D54.
Analysis revealed similarities between this attack and a previous incident on the same bridge in May 2026. Both leveraged an identical vulnerability, but July’s exploit appeared to originate from a different attacker using a new wallet.
Blockaid noted this latest breach exploited the same contract and entry path as the May attack, and described both incidents as sharing an identical bug class, pointing to persistent flaws in validation logic for bridge transfers.
PeckShieldAlert reported that the attacker soon began laundering the stolen assets through Tornado Cash. At the time of the incident, VerusCoin had not yet released any public statements.
The May incident on the VerusCoin bridge involved a manipulation of its cross-chain export process, enabling the attacker to extract $11.58 million for a relatively low transaction fee.
Mini dictionary: VerusCoin is a blockchain platform focused on privacy and interoperability, allowing users to move assets across different chains through its bridging technology.
| Bridge | Date of Exploit | Amount Stolen | Assets Affected |
|---|---|---|---|
| AFX Trade (Arbitrum) | July 22, 2026 | $24.15 million | USDC |
| VerusCoin Ethereum Bridge | July 23, 2026 | $7.54 million | ETH, tBTC, USDC, USDT, EURC, MKR, scrvUSD |
| VerusCoin Ethereum Bridge | May 2026 | $11.58 million | Multiple currencies |
Security sector response and ongoing investigations
These incidents have brought renewed scrutiny to the recurring vulnerabilities affecting cross-chain bridges, which have previously experienced high-profile breaches including those involving Wormhole and Nomad in 2022.
Blockaid indicated that the root causes in the VerusCoin exploits involved missing checks on incoming transfer values, a class of bugs observed previously in the sector. Security firms, including SlowMist and PeckShieldAlert, are actively monitoring the stolen funds and collaborating with exchanges and other ecosystem partners to track suspicious wallet activity.
Neither AFX nor VerusCoin has provided a date for restoring bridge operations. Both investigations remain open, and recovery or remediation plans have not yet been announced as authorities and security teams work to follow the movements of the stolen assets.
