Two Ethereum bridges lose $31.7M within hours as third protocol halts staking
AFX and the Verus-Ethereum bridge suffered about $31.69 million in mixed losses within hours of one another, whereas B² Network individually suspended token staking after unauthorized entry to a contract improve authority.
Blockaid said it detected the AFX exploit at about 21:30 UTC on July 22. An Arbitrum transaction recorded 24.15 million USDC leaving the bridge operated by AFX, a decentralized buying and selling protocol on Arbitrum.
AFX suspended its USDC custody bridge and mentioned the incident was remoted from its buying and selling infrastructure, mainnet, and the Arbitrum community. The affected element was a third-party bridge, not Arbitrum’s native bridge.
In preliminary findings published July 24, AFX attributed the incident to coordinated social engineering and infrastructure compromise. The protocol mentioned entry appeared to start in a improvement atmosphere earlier than escalating into inside construct infrastructure and validator techniques.
AFX mentioned it was verifying balances, pursuing fund restoration and making ready remediation. As of July 24, it had not introduced a accomplished return of funds or a finalized compensation plan.
Hours after the AFX incident, an Ethereum transaction confirmed the Verus bridge releasing 1,137.4528 ETH and 7 token transfers. Blockaid valued the unbacked payouts at about $7.54 million.
SlowMist’s analysis mentioned the bridge permitted eight withdrawals with out proving that matching belongings backed them. The agency linked the failure to the identical broad cross-chain import-validation class as a May exploit, however mentioned the 2 assaults used totally different mechanics.
B²’s incident was not disclosed as a bridge exploit. The community said there was unauthorized entry to its staking contract’s improve authority. B² suspended regular staking throughout safety opinions, mentioned the difficulty was contained, and promised full compensation to affected customers. It had not documented accomplished restitution as of July 24.
B² additionally provided a handbook exit: customers may request unstaking by its official Discord, with ownership-verified requests to be processed within one enterprise day. The community didn’t state a loss quantity, so its incident is excluded from the $31.69 million bridge-loss whole. Until regular staking resumes, that handbook evaluation is the route B² provided customers looking for to withdraw staked tokens.
The three episodes uncovered totally different controls outdoors base-chain consensus. AFX’s custody and validator infrastructure, Verus’s bridge-accounting checks, and B²’s staking-contract improve authority every grew to become the purpose the place regular entry failed.
For customers, the following take a look at is whether or not restoration plans return funds, whether or not cross-chain validation verifies financial backing and whether or not improve authority is protected with out making emergency exits rely on handbook intervention.
The put up Two Ethereum bridges lose $31.7M within hours as third protocol halts staking appeared first on CryptoSlate.
