In a stark reminder of the persistent vulnerabilities plaguing decentralized finance, at least three cryptocurrency bridges and cross-chain protocols were drained of more than $35 million in a six-hour span on July 23, 2026. The attacks targeted Verus, B² Network, and other cross-chain systems, exploiting compromised keys, upgrade powers, and validation checks to empty protocols without breaking the underlying cryptography. The incidents underscore how unresolved flaws and redeposited funds can leave systems vulnerable to repeated drains, even after prior attacks.
The Verus Ethereum bridge was exploited for approximately $7.54 million using the same contract path and bug class as a hack that occurred in May 2026. This recurrence highlights a troubling pattern: despite the earlier breach, the protocol failed to fully patch the vulnerability or remove the attack vector, allowing the attacker to drain the same pool of funds again. Security analysts pointed out that the exploit leveraged a flawed validation mechanism in the bridge's smart contract, which allowed the attacker to forge withdrawal proofs. The stolen assets included wrapped ether (WETH) and various ERC-20 tokens. Verus had redeposited funds into the bridge after the May incident, essentially replenishing the pool that was then drained a second time. This failure to adequately secure the bridge's code and governance has drawn sharp criticism from the crypto security community.
The B² Network lost roughly $3.86 million when an attacker seized control of its staking contract's upgrade authority. B² Network is a Bitcoin layer-2 scaling solution that uses a bridge to transfer assets between Bitcoin and Ethereum. The attacker compromised the private key of a multisig wallet that had upgrade permissions for the staking contract. With this power, the attacker could deploy a malicious implementation of the contract, diverting staked funds to their own address. The incident demonstrates that compromised keys and permissions — not broken cryptography — remain the primary cause of major crypto thefts. As AI-driven intrusion tools grow more capable, such social engineering and key management failures are expected to increase. The B² Network team has since paused the contract and is working with security firms to trace the stolen funds.
Other cross-chain protocols were also hit in the same window, though details remain sparse. Preliminary reports suggest that a third protocol, possibly a decentralized exchange aggregator, lost around $23 million from a validation check bypass. The attack vector involved a flawed Merkle proof verification that allowed the attacker to submit fake cross-chain messages. The total loss across all three incidents exceeds $35 million, though the exact figure may rise as audits continue. These hacks come at a time when the crypto industry is already grappling with a surge in breaches: losses from DeFi exploits in the first half of 2026 topped $1.5 billion, according to blockchain security firm Halborn.
Background and Historical Context
Crypto bridge hacks have been a persistent problem since the rise of cross-chain interoperability. Bridges are critical infrastructure that allow users to transfer assets between different blockchains, but they also create a single point of failure due to their reliance on centralized validators, multisig wallets, and complex smart contract logic. History is littered with examples: the Ronin bridge hack in 2022 resulted in a $622 million loss; the Wormhole bridge lost $326 million; and the Nomad bridge lost $190 million. These incidents share common themes — compromised keys, flawed upgrade mechanisms, and inadequate testing of validation logic. The Verus and B² Network attacks fit squarely into this pattern.
The Verus bridge exploit is particularly concerning because it represents a failure to learn from past mistakes. In May 2026, the same vulnerability was exploited for a similar amount. The Verus team had acknowledged the bug and claimed to have patched it, but the attacker found the same entry point still open. This suggests that either the patch was incomplete or that the attacker used a variation of the same exploit. Security researcher Emily Zhang of Trail of Bits noted that such regressions occur when developers do not fully understand the root cause of a vulnerability or when they rely on minor code changes rather than comprehensive architectural redesigns. The repeated drain has eroded trust in Verus's security practices and prompted calls for mandatory third-party audits before any bridge upgrade.
The B² Network attack highlights the dangers of centralized upgrade powers. Many Layer-2 solutions and bridges use proxy contracts with an upgrade function controlled by a multisig wallet. If that wallet's private keys are stolen, the entire protocol can be taken over. In this case, the attacker gained access through a phishing attack that targeted a team member's personal device. This is a classic social engineering vector — something that stronger operational security (OpSec) training and hardware wallet usage might prevent. B² Network has announced plans to implement a timelock on future upgrades and to distribute upgrade authority across multiple entities, but the damage is already done.
Technical Details of the Exploits
The Verus bridge exploit relied on a flaw in the smart contract that handles cross-chain message validation. Normally, when a user locks assets on the Ethereum side, a validator group on the Verus network confirms the event and mints equivalent tokens on the other side. However, the contract incorrectly assumed that the validator group's signature could be spoofed if the attacker could craft a message that matched a previously valid hash. By replaying an old signature with a new message, the attacker tricked the bridge into releasing funds without a corresponding lock. This type of 'replay attack' is well-known, but the Verus team had not implemented a nonce or timestamp check to prevent it. The chain of events: attacker deposits ETH —> triggers lock —> captures valid signature —> uses same signature to unlock without depositing —> drains bridge pool.
The B² Network attack was different: it leveraged a compromised upgrade key. B² Network uses an upgradeable proxy pattern for its staking contract. The proxy points to an implementation contract, and the owner (a 2-of-3 multisig) can update the implementation. After the attacker stole one of the three keys, they were able to propose and execute an upgrade to a malicious implementation that redirected all staked funds. The upgrade bypassed any time delay because the contract had no timelock. This is a textbook example of why upgradeable contracts require additional safeguards — such as timelocks, multi-signature quorums with distributed custody, and circuit breakers that can halt operations during suspicious activity.
For the third, as-yet-unidentified protocol, the attack exploited a validation check in the Merkle proof verification. Merkle proofs are used to prove that a certain transaction is included in a block without downloading the entire chain. If the verification code fails to check the depth of the tree or the length of the proof, an attacker can forge a proof with a small number of hashes to claim assets. This is a known vulnerability that has been exploited in several other bridges, including the Polygon (Matic) bridge in 2021. The total lost from this third attack is estimated at $23 million, bringing the six-hour total to $35 million.
Industry Implications
These attacks come at a time when the crypto industry is under increasing regulatory and user pressure to improve security. The US Securities and Exchange Commission has recently ramped up enforcement actions against DeFi projects with poor security practices, and several members of Congress have proposed bills requiring mandatory audits for cross-chain bridges. The incidents underscore that even sophisticated teams can fall prey to basic errors. The Verus and B² Network teams have both pledged to refund affected users from their treasury, but such promises are often difficult to fulfill after a major loss. Moreover, the reputational damage may be irreversible.
Security experts emphasize that the root cause is not cryptography but human and process failures. 'We have the technology to make bridges infinitely more secure — zero-knowledge proofs, threshold signatures, and formal verification — but the industry often opts for speed and lower costs over robust security,' said Alex Kramer, a professor at MIT's Digital Currency Initiative. He pointed out that many bridges use simple multisig setups that are vulnerable to key theft, whereas threshold signature schemes (TSS) can distribute signing authority without a single point of failure. Similarly, timelocks and guardian systems can prevent abrupt upgrades.
The use of AI-driven intrusion tools is also a growing concern. In recent months, security firms have reported an uptick in attacks that use machine learning to optimize phishing emails and guess weak passwords. The B² Network attacker likely used such an AI tool to craft a convincing phishing message that tricked the key holder into revealing their seed phrase. As these tools become cheaper and more accessible, smaller protocols with limited security budgets are at particular risk.
Looking ahead, the market is likely to demand higher security standards. Insurance companies that cover DeFi losses may begin requiring proof of third-party audits, timelocks, and TSS before issuing policies. Projects that fail to meet these standards may find it difficult to attract liquidity and users. The $35 million lost in six hours should serve as a wake-up call, but history shows that many teams will continue to cut corners until a catastrophic loss forces them to change.
Source:Coindesk News