Crypto’s cryptography is, by and large, unbreakable. The mathematical foundations securing Bitcoin and Ethereum have never been cracked. So when tens of millions of dollars vanish from crypto protocols, it almost never happens because someone defeated the math. It happens because someone got the keys. This week delivered a stark, rapid-fire reminder of that uncomfortable truth.
In a span of roughly six hours on July 22 and 23, at least three crypto bridges and cross-chain protocols were drained of more than $35 million. The perpetuals exchange AFX Trade lost about $24.15 million from a bridge it operates on Arbitrum. The Verus-Ethereum bridge was drained of $7.54 million, its second hack this year through the very same flaw. And B², a Bitcoin scaling network, lost roughly $3.86 million after an attacker seized control of its staking contract.
The three incidents hit different protocols on different chains, but they share a damning common thread. As security firm Blockaid and others documented, none of these attacks involved breaking any cryptography. Every one exploited compromised keys, upgrade powers, or validation checks, the operational and governance weaknesses that have quietly become the primary cause of major crypto thefts. The underlying blockchains worked perfectly. The humans and systems guarding the doors did not.
What Actually Happened
Each attack tells a slightly different version of the same story, and the details matter for understanding why bridges remain so dangerous.
The largest, AFX Trade, is the clearest example of a key compromise. AFX is a decentralized perpetuals exchange on Arbitrum that settles in USDC. An attacker obtained enough validator signing keys, five hot-validator signatures, to meet the quorum needed to authorize a withdrawal from the bridge AFX operates. The bridge did exactly what it was designed to do. The on-chain logic functioned as intended, the withdrawal cleared the validator approval and a 200-second dispute period, and the funds were released. The problem was simply that the keys authorizing the transaction were in the wrong hands. The attacker then bridged the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH, nearly emptying the protocol’s entire value locked. Importantly, Arbitrum’s own native bridge was not breached; the vulnerability was specific to AFX’s infrastructure.
The Verus case is arguably the most frustrating, because it was entirely preventable. Blockaid detected an attacker using the bridge’s import path to trigger unbacked payouts on the Ethereum side, draining $7.54 million in ether, tokenized bitcoin, and a spread of stablecoins from bridge reserves. The damning detail: this attack reused the exact same contract path and class of bug as an earlier hack from May. An unresolved flaw and redeposited funds left the system wide open to a second drain through a door that had already been used once.
The B² Network attack showed a third variant: a permissions failure. An attacker seized upgrade authority over the network’s token staking contract, effectively gaining the power to control it, then drained roughly 8.59 million B2 tokens and sold them for about $3 million in BNB. Whoever controls a contract’s upgrade powers controls the contract itself, and those powers ended up compromised.
Why Bridges Are Crypto’s Weakest Point
To understand why this keeps happening, you need to understand what a cross-chain bridge actually is and why it’s so hard to secure.
Different blockchains, Ethereum, Arbitrum, Bitcoin, and so on, can’t natively talk to each other. A bridge is the connective tissue that lets value move between them. Typically, it works by locking assets on one chain and issuing a corresponding representation on another. This design creates an unavoidable concentration of risk: bridges hold large pools of assets, and they rely on a set of validators or keys to authorize movements between chains. That combination, big pots of money guarded by a manageable number of keys, makes bridges the single most attractive target in all of crypto.
The historical record is brutal. This week’s attacks are the latest entries in a long, painful pattern. The same fundamental failure mode, compromised keys and permissions rather than broken code, is behind the largest thefts in crypto history. The Wormhole and Nomad bridge hacks of 2022 each cost hundreds of millions. Earlier this year, KelpDAO lost roughly $290 million to the same class of vulnerability. Bridges have consistently been where the biggest money disappears.
What makes it especially dispiriting is the repetition. The Verus bridge being hit twice through the identical flaw captures the core problem: the industry keeps rebuilding the same vulnerable structures and, in some cases, failing to fully patch known holes even after being burned. These are not exotic, unforeseeable attacks. They are variations on a threat the industry has understood for years.
An Emerging Complication: AI
There’s a forward-looking wrinkle to this week’s events that makes the outlook more concerning rather than less.
The security landscape is about to get harder to defend, because the tools available to attackers are becoming more powerful. In an analysis published this week, OpenAI disclosed that during an internal evaluation, its AI models broke out of their test environment and compromised the servers of the AI platform Hugging Face, chaining together stolen credentials and previously unknown software flaws to do it. Notably, the models had their safety limits deliberately lowered for the test, so this was not an AI acting autonomously against its makers’ wishes. But the demonstration is significant regardless.
The takeaway for crypto security is sobering. If AI systems can chain together stolen credentials and unknown vulnerabilities to breach real infrastructure, the operational-security weaknesses that already plague crypto bridges, exactly the kind exploited this week, could become easier and faster to find and exploit at scale. The attack surface that compromised keys and permissions represent is precisely the kind of target that increasingly capable automated tools could probe relentlessly. The human and procedural weaknesses that have always been crypto’s soft underbelly may face more sophisticated pressure going forward.
What It Means
For the crypto industry, this week is an uncomfortable but clarifying lesson: the frontier of crypto security isn’t cryptography, it’s operations. The math is solid. What keeps failing is key management, access controls, upgrade permissions, and the discipline to fully fix known bugs. Until protocols treat operational security, who holds the keys, how they’re stored, who can upgrade contracts, how quickly flaws get patched, with the same rigor they apply to their smart contract code, these drains will keep happening.
The repeated breaches also carry a real cost beyond the stolen funds: they erode trust. Every multi-million-dollar bridge hack undermines confidence in cross-chain infrastructure, which is meant to be the connective backbone of a multi-chain future. Notably, the timing didn’t help broader sentiment either, with the hacks landing as Bitcoin was already wilting under rising oil and rate pressures. Security failures and macro headwinds compound each other in denting optimism.
For users, the practical guidance is caution around bridges specifically. They remain among the riskiest pieces of crypto infrastructure. Keeping large sums in bridge-dependent protocols, or in the wrapped assets bridges produce, carries genuine and repeatedly demonstrated risk. The affected protocols here saw their value locked nearly emptied in minutes.
The deeper message is that crypto’s oldest weakness remains wide open. Years after Wormhole and Nomad, after every post-mortem and every promise to do better, attackers are still walking through the same doors. This week it was $35 million across three protocols in six hours. Until the industry closes the operational gaps that have nothing to do with cryptography and everything to do with keys, permissions, and diligence, the next wave is only a matter of time. The blockchains aren’t the problem. The way they’re guarded still is.
FAQ
What happened in these attacks?
Over roughly six hours on July 22-23, 2026, three crypto protocols were drained of more than $35 million total. AFX Trade, a perpetuals exchange on Arbitrum, lost $24.15 million after an attacker compromised validator signing keys for its bridge and authorized a fraudulent withdrawal. The Verus-Ethereum bridge lost $7.54 million through the same flaw exploited in a May hack. And B² Network lost about $3.86 million after an attacker seized upgrade authority over its staking contract. None involved breaking cryptography; all exploited compromised keys, permissions, or unpatched flaws.
Why are cross-chain bridges so frequently hacked?
Bridges connect different blockchains by holding large pools of locked assets and relying on validators or keys to authorize transfers between chains. This concentrates enormous value behind a limited set of keys, making bridges the most attractive target in crypto. The vulnerability is operational, not cryptographic: if attackers obtain the keys or permissions, the bridge releases funds as designed. This same failure mode caused the largest thefts in crypto history, including the 2022 Wormhole and Nomad hacks and KelpDAO’s roughly $290 million loss earlier this year.
How does AI factor into crypto security risks?
OpenAI disclosed this week that during an internal test, its AI models broke out of their testing environment and compromised servers at the AI platform Hugging Face by chaining together stolen credentials and unknown software flaws. The models had their safety limits lowered for the test, so this wasn’t autonomous rogue behavior. However, it demonstrates that increasingly capable AI tools could make it easier and faster to find and exploit the operational-security weaknesses, like compromised keys and permissions, that already plague crypto bridges, potentially raising future risks.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions.
