Three Crypto Bridge Hacks in DeFi Vanish $35.6M in One Day!

Three separate crypto bridge hacks wiped out more than $35.6 million in a single day. The attacks hit AFX Trade, BSquared, and VerusCoin, exposing serious security flaws across the DeFi sector. The attackers have already moved most of the stolen funds.

Blockchain investigators say each exploit followed a very different attack method, raising fresh concerns over bridge security.

AFX Bridge Loses $24.2 Million

The biggest hack hit AFX’s bridge on Arbitrum, where attackers stole 24.15 million USDC, worth about $24.2 million.

According to blockchain security firm Blockaid, the bridge approved the withdrawal using five signatures from its seven-validator system. This suggests the attackers may have gained access to validator keys or the bridge’s backend system.

After stealing the funds, the hacker quickly moved the USDC from Arbitrum to Ethereum.

In response to this, the AFX team said it is working with the Arbitrum team and security firms to investigate the exploit and trace the stolen funds.

BSquared Loses Nearly $3.9 Million in B2 Token Hack

The second attack targeted the BSquared Network, where hackers stole 8.59 million B2 tokens, worth around $3.86 million.

The attacker immediately sold the stolen B2 tokens for 5,409 BNB, worth about $3.01 million. The funds were then bridged to Ethereum, converted into ETH and USDT, and later moved through NEAR Intents and HOT Protocol to make tracking harder.

Security teams continue to monitor the wallet as the investigation remains active.

VerusCoin Hit Again as Old Bridge Bug Returns

The VerusCoin Ethereum bridge suffered the third attack, losing $7.54 million worth of assets, including Ether (ETH), tokenized Bitcoin (tBTC), USDC, USDT, DAI, and several other tokens.

According to SlowMist, the attack reused the same import path contract bug that hackers exploited during a separate $11.5 million hack in May 2026. The weakness allowed the attacker to trigger unbacked payouts, meaning the bridge released assets without checking whether enough funds actually backed the transactions.

After draining the bridge, the attacker converted the stolen assets into 3,916 ETH, worth about $7.5 million, before sending the funds to Tornado Cash, making recovery much more difficult.