AFX and the Verus-Ethereum Bridge suffered combined losses of around $31.69 million within hours of each other, while B² Network separately suspended token staking after unauthorized access to a contract upgrade authority.
Blockaid said it detected the AFX exploit around 9:30 p.m. UTC on July 22. An Arbitrum transaction recorded 24.15 million USDC leaving the bridge operated by AFX, a decentralized trading protocol on Arbitrum.
AFX suspended its USDC custody bridge and said the incident was isolated to its trading infrastructure, mainnet, and the Arbitrum Network. The affected component was a third-party bridge, not Arbitrum’s native bridge.
In its preliminary findings released on July 24, AFX attributed the incident to coordinated social engineering and infrastructure compromise. The protocol states that access appears to begin in a development environment before moving into internal build infrastructure and validation systems.
AFX said it is verifying balances, pursuing fund recovery and preparing corrective actions. As of July 24, it had not announced a final reimbursement or a finalized compensation plan.
Hours after the AFX incident, an Ethereum transaction showed the Verus bridge releasing 1,137.4528 ETH and seven token transfers. Blockaid valued the unsecured payments at approximately $7.54 million.
SlowMist’s analysis indicates that the bridge approved eight withdrawals without proving that corresponding assets supported them. The company linked the failure to the same cross-chain import validation class as a May exploit, but said the two attacks used different mechanisms.
The B² incident was not disclosed as a bridge exploit. The network said there was unauthorized access to its staking contract upgrade authority. B² suspended normal staking during security reviews, said the issue was under control, and promised full compensation to affected users. He had not documented full restitution as of July 24.
B² also offered a manual exit: users could request deactivation through its official Discord, with requests verified by the property to be processed within one business day. The network did not indicate the amount of the loss, so its incident is excluded from the bridge’s total loss of $31.69 million. Until normal staking resumes, this manual review is the route B² offers users looking to withdraw staked tokens.
The three episodes exposed different controls outside of the basic channel consensus. AFX’s custody and validation infrastructure, Verus’s transition accounting controls, and B²’s staking contract upgrade authority each became the point where normal access failed.
For users, the next test is whether stimulus packages return funds, whether cross-chain validation verifies economic support, and whether upgrade authority is protected without emergency exits relying on manual intervention.
