AFX and the Verus-Ethereum bridge suffered a combined loss of approximately $31.69 million within hours, while B² Network separately suspended token staking following unauthorized access to the contract upgrade authority.
Blockaid announced that it detected the AFX exploit on July 22 at approximately 21:30 UTC. Arbitrum transactions recorded an outflow of 24.15 million USDC from a bridge operated by AFX, a decentralized trading protocol on Arbitrum.
AFX suspended the USDC custodial bridge and said the incident was isolated from its trading infrastructure, mainnet, and Arbitrum network. The affected component was a third-party bridge rather than Arbitrum’s native bridge.
In preliminary findings released on July 24, AFX believed the incident was a coordinated combination of social engineering and infrastructure compromise. According to the protocol, access appears to have started in the development environment and then expanded to internal build infrastructure and verification systems.
AFX said it has confirmed the balance, is proceeding with the recovery of funds, and is preparing to make corrections. As of July 24, no completion of the return of funds or a final compensation plan has been announced.
Hours after the AFX incident, Ethereum transactions showed that Verus Bridge released 1,137.4528 ETH and 7 token transfers. Blockaid valued the unsubstantiated payments at approximately $7.54 million.
According to Slowmist’s analysis, Bridge approved eight withdrawals without proving the backing of matching assets. The company tied the failure to the same broad cross-chain import validation class as the May exploit, but said the two attacks used different mechanisms.
The B² incident was not disclosed as a bridge exploit. The network announced that there had been unauthorized access to the upgrade privileges for staking contracts. B² suspended regular staking during a security review, stated the issue was contained, and promised full compensation to affected users. As of July 24, the completion of the return has not been documented.
B² also provided manual termination. Users can request unstaking through the official Discord, and requests with verified ownership will be processed within one business day. The network did not disclose the amount of the loss, so this incident was excluded from Bridge’s total loss of $31.69 million. Until regular staking resumes, manual review is the route B² will offer users who wish to withdraw their staked tokens.
The three episodes revealed different controls outside of basechain consensus. AFX’s storage and validation infrastructure, Verus’ bridge accounting checks, and B²’s staking contract upgrade privileges each became points where normal access would fail.
The next test for users is whether the recovery plan returns funds, whether cross-chain validation verifies financial backing, and whether upgrade privileges are protected without an emergency escape relying on manual intervention.
(Tag translation) Featured
