Three crypto protocols drained of $35.5m in a single day of DeFi attacks
Three protocols, AFX Trade, Verus and B² Network, lost a combined $35.55m on 23 July 2026: AFX from its USDC bridge, Verus to a repeat of its May flaw with the funds sent through Tornado Cash, and B² after its staking upgrade key was seized.
Listen to this article
Three crypto protocols were emptied on the same day, and the losses ran to tens of millions.
On 23 July 2026, attackers drained about $35.55m from three separate protocols. AFX Trade on Arbitrum lost the most, followed by the Verus Ethereum bridge and the Bitcoin layer-2 B² Network. Here is what happened at each.
The three hits
| Protocol | Chain | Lost | How |
|---|---|---|---|
| AFX Trade | Arbitrum | $24.15m | USDC bridge exploited; bridge operations suspended |
| Verus | Ethereum bridge | $7.54m | Forged cross-chain proof, the same flaw as its May hack |
| B² Network | Bitcoin layer-2 | $3.86m | Attacker seized the staking contract’s upgrade authority |
AFX Trade: the biggest loss
AFX Trade, a decentralised perpetuals exchange that settles in USDC, lost the most: about $24.15m from the USDC custody bridge it runs on Arbitrum. The team suspended bridge operations once the drain was spotted.
One point is worth stating clearly, because it will get blurred: this was not Arbitrum’s own bridge. “We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Arbitrum said. The failure was in AFX’s own bridge.
Verus: the same door, forced twice
The Verus Ethereum bridge lost $7.54m to the same flaw that cost it more than $11m in May. The bridge did not properly verify the Verus-side input, so an attacker forged the cross-chain proof and triggered unbacked payouts on the Ethereum side, draining ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD from the reserves. The stolen funds were converted into about 3,916 ETH and moved through Tornado Cash and other mixers. Verus held close to $100m in total value locked at the start of 2025. It is down to single-digit millions now.
B² Network: staking contract seized
B² Network, a Bitcoin layer-2, lost $3.86m after an attacker took over the upgrade authority on its staking contract, the control that decides what the contract is allowed to do. In its own statement, B² said it had identified the incident the same day, contained it, and temporarily suspended B2 staking while it completed further security reviews. It said all affected users would be fully compensated, and pointed holders who want to unstake to its official Discord.
Where it stands
AFX has paused its bridge, B² has paused staking and promised full reimbursement, and Verus, already cut down by its May hack, has little left in its bridge to lose. The Verus funds have already been run through a mixer, which makes recovery hard. Across all three, tracing, exchange freezes and each team’s own response now decide how much comes back.
All three are now logged in our Attack Log, the running record of major crypto exploits: what was hit, how much was lost, and how each attack worked.
