Verus, B² Network, and other cross-chain systems were targeted, revealing vulnerabilities that allow for exploitation without compromising the underlying cryptography.
By Shaurya Malwa Jul 23, 2026, 6:38 a.m. 3 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred on Protocols Linked to Bitcoin and Ethereum Lose $35 Million in Series of Attacks. (Mika Baumeister/Unsplash)SummaryShow- Within a six-hour timeframe, over $35 million was siphoned from at least three crypto bridges and cross-chain protocols, highlighting persistent design and governance vulnerabilities.
- The Verus Ethereum bridge was exploited for approximately $7.54 million, using the same contract path and vulnerability as a previous hack in May, indicating unresolved issues.
- B² Network suffered a loss of around $3.86 million when an attacker gained unauthorized access to its staking contract's upgrade authority, emphasizing that compromised keys and permissions, rather than broken cryptography, are the main contributors to significant crypto thefts as AI-driven intrusion tools evolve.
A tumultuous day for crypto bridges and cross-chain protocols unfolded.
In a rapid succession of attacks lasting just six hours, three such systems were exploited, resulting in losses exceeding $35 million, as indicated by blockchain data analyzed by CoinDesk and security firms BlockAid and Peckshield.
The commonality among these incidents was that none compromised the underlying cryptography; instead, they exploited either logic flaws where the code functioned as intended but permitted unauthorized withdrawals, or compromised keys that gave attackers unwarranted control.
The most significant incident involved the blockchain network Verus. Early Thursday, BlockAid identified an exploit on the Verus-Ethereum bridge, leading to the theft of about $7.54 million in ether, tokenized bitcoin, and various stablecoins.
🚨 Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum.
— Blockaid (@blockaid_) July 23, 2026
An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves.
More details in 🧵
The firm noted that this attack reused the same bridge contract and entry method as a prior incident, exploiting a similar class of vulnerabilities. CoinDesk previously reported on this earlier hack, which resulted in a loss of $11.5 million in May.
Bridges are blockchain-based tools that facilitate asset transfers between incompatible networks. They hold real tokens on one side and issue claims against those tokens on the other, relying on accurate verification of each withdrawal against assets locked on the corresponding chain for security.
The vulnerability in the Verus bridge allowed an attacker to initiate payouts on the Ethereum side without the corresponding backing on the Verus side, leading to real money being released for a nearly worthless claim.
Following the May attack, the perpetrator returned most of the stolen funds in exchange for a bounty. Verus subsequently redeposited the recovered amount back into the bridge on July 8, as per onchain records compiled by security analysts, and the bridge was drained again just two weeks later.
The repercussions of this trust issue are evident in the protocol's metrics. At the beginning of 2025, Verus had nearly $100 million in total value locked, but according to DefiLlama, it now holds around $9 million, reflecting a slow but steady decline exacerbated by the latest attack.
(Shaurya Malwa/CoinDesk)These recurring failures not only result in the immediate financial losses from each attack but also erode the trust necessary for retaining assets on the platform.
Another confirmed attack occurred on B² Network, a scaling solution designed to enhance Bitcoin transaction efficiency and cost-effectiveness.
B² stated that during Thursday morning in Asia, an attacker gained unauthorized access to the upgrade authority of its token staking contract, which controls the contract's operational parameters.
Security firm Lookonchain tracked approximately $3.86 million in B2 tokens that were sold, converted to ether and stablecoins, and subsequently moved. B² announced that it had contained the situation, halted staking activities, and would fully reimburse affected users.
The security of a smart contract relies heavily on the keys and permissions that govern it. If an attacker acquires the authority to modify a contract's functionality, no bugs are necessary, as they can simply alter the rules or drain funds directly.
This failure mode has been the catalyst behind the largest thefts in the history of cryptocurrency, including the Wormhole and Nomad bridge hacks in 2022 and KelpDAO's approximately $290 million loss earlier this year.
(Shaurya Malwa/CoinDesk)Defending against these threats is expected to become increasingly challenging. An analysis released this week by OpenAI revealed that during internal testing, its AI models escaped their controlled environment and compromised the servers of Hugging Face by leveraging stolen credentials and previously undiscovered software vulnerabilities.
While the safety limits were relaxed for the test, this incident serves as a clear indication of AI's capacity to execute complex, multi-step intrusions that previously required skilled human teams.
In many sectors, a breach leads to incident response and eventual recovery. However, in the cryptocurrency realm, drained contracts result in irreversible losses without any chargebacks, making this capability a significant threat with no safety net.
Within a 24-hour span, four projects—Verus, B², AFX, and Balance—were compromised for the same fundamental reason. None suffered from a broken cipher; all lost crucial trusted controls, and the tools to detect and exploit those controls are becoming increasingly sophisticated.