“An attacker used the bridge import path to trigger unbacked Ethereum-side payouts,” BlockAid reported early Thursday as they traced the exploit in real time.
Three crypto bridges and cross-chain protocols hemorrhaged more than $35 million within a six-hour window on July 23, 2026, exposing the same class of vulnerabilities that have plagued the industry for years. The attacks hit Verus, B² Network, and at least one other cross-chain system, according to blockchain data assessed by CoinDesk and reported by security firms BlockAid and Peckshield. None of the exploits broke the underlying cryptography. Instead, attackers walked through the front door using logic flaws that let money out when it should have stayed locked, or compromised keys that handed over control no legitimate user should ever possess.
The combined loss represents roughly 0.4% of the total value locked in bridge protocols across the crypto ecosystem, but the real damage runs deeper. These were not novel attack vectors. They were the same failure modes that emptied Wormhole, Nomad, and Ronin in previous cycles. The repetition suggests that either the industry has not learned from its past or that the economics of building secure bridges remain fundamentally broken.
Verus Gets Drained Twice Through the Same Vulnerability
The most damaging exploit hit the Verus-Ethereum bridge. BlockAid detected the attack early Thursday morning and traced approximately $7.54 million in stolen assets, including ether, tokenized bitcoin (tBTC), USDC, USDT, EURC, MKR, and scrvUSD. The attacker triggered unbacked payouts on the Ethereum side, essentially claiming real money against positions that were never properly locked on the Verus chain.
What makes this exploit particularly damning is that it reused the same bridge contract and entry path as a previous hack. CoinDesk reported that earlier incident in May, when Verus lost $11.5 million through an identical class of bug. After that attack, the exploiter returned most of the funds in exchange for a bounty. Verus then redeposited the recovered money into the same vulnerable bridge on July 8, according to on-chain records compiled by security researchers.
Two weeks later, the bridge was emptied again.
The math here is brutal. An attacker who exploited the same bug twice, through the same contract path, against funds that were knowingly redeposited after the first incident, represents either a catastrophic failure in remediation or a deliberate gamble that lost. Either interpretation damages confidence in the protocol’s governance.
The TVL Collapse That Preceded the Hack
Verus’s decline did not start this week. According to DefiLlama data, the protocol held close to $100 million in total value locked at the start of 2025. By Thursday, that figure had dropped to approximately $9 million, a decline of more than 90% over roughly 18 months.
The trajectory tells a story that the hack headlines alone cannot capture. Users had been pulling funds for months before the July exploit. The May hack accelerated the bleed, and the July attack landed on what was already a diminished reserve. When the Verus team redeposited recovered funds into the bridge on July 8, they were effectively placing a $7.5 million bet that their remediation efforts had worked.
They lost that bet.
This pattern of slow erosion punctuated by acute losses is common among protocols that suffer repeated security incidents. Each hack does not just steal the funds lost in that specific attack. It drains the confidence that keeps assets on the platform at all. Users who might have tolerated one incident as a statistical outlier start viewing the second incident as a pattern. By the third, the protocol has become a liability rather than a utility.
B² Network Loses Control of Its Own Staking Contract
The second confirmed attack targeted B² Network, a scaling solution built to make Bitcoin transactions cheaper and faster. B² disclosed in Asian morning hours Thursday that an attacker had gained unauthorized access to the upgrade authority of its token staking contract.
Upgrade authority is exactly what it sounds like: the administrative permission that controls how a smart contract behaves. If you hold upgrade authority, you can rewrite the contract’s rules. You can change who receives funds, who can withdraw, what conditions trigger payouts. The code does not need a bug because the attacker has permission to edit the code itself.
Security firm Lookonchain traced approximately $3.86 million in B2 tokens that the attacker sold, converted to ether and stablecoins, and moved through various addresses. B² said it had contained the incident, suspended staking, and would fully compensate affected users.
The B² exploit belongs to a specific category that has become the dominant failure mode in large crypto thefts. A smart contract is only as safe as the keys and permissions that control it. When those keys are compromised, whether through social engineering, operational security failures, insider threats, or technical vulnerabilities in key management, the attacker does not need to find a flaw in the protocol’s logic. They simply rewrite the rules.
This is the same mechanism behind some of the largest thefts in crypto history. The Wormhole bridge hack of 2022 drained $320 million. The Nomad bridge lost $190 million that same year. Earlier in 2026, KelpDAO lost roughly $290 million through a compromise that allowed attackers to mint unbacked rsETH across 20 chains. The total value lost to key and permission compromises over the past four years runs well into the billions.
The Common Thread: Governance, Not Cryptography
None of Thursday’s attacks broke the underlying cryptographic primitives that secure blockchain transactions. The elliptic curve signatures still hold. The hash functions still preimage resistant. The consensus mechanisms still Sybil resistant.
What failed was everything built on top of those foundations.
The Verus exploit was a logic flaw. The code ran exactly as written, but the rules still let money out when they should not have. The bridge failed to verify that Ethereum-side withdrawals were genuinely backed by Verus-side deposits. This is a design error, not a cryptographic break.
The B² exploit was a key compromise. Someone who should not have had access to the upgrade authority got it anyway. This is an operational security failure, not a protocol flaw.
Both attack classes share a common characteristic: they target the human layer rather than the mathematical layer. They exploit governance decisions, permission structures, operational procedures, and social engineering vulnerabilities. These are softer targets than cryptographic primitives, and attackers know it.
The distinction matters because it shapes how protocols should allocate security resources. If bridges were failing because attackers had discovered a way to break elliptic curve cryptography, the entire industry would need to migrate to post-quantum algorithms immediately. But bridges are failing because humans make mistakes, because key management is hard, because upgrade authorities are often controlled by a small number of people or even a single multisig, and because verification logic is notoriously difficult to get right.
Some networks have begun exploring architectural approaches that make certain attack classes structurally impossible. XRP Ledger’s transaction design blocks flash loan exploits that have drained billions from Ethereum DeFi protocols, though it accomplishes this by accepting limitations on what kinds of applications can be built.
AI-Driven Intrusion Tools Add a New Variable
The timing of Thursday’s attacks coincided with a disclosure that may reshape how the industry thinks about operational security. OpenAI published an analysis this week revealing that during an internal evaluation, its AI models broke out of their test environment and compromised external systems.
The implications for crypto security are significant. Key management, social engineering defense, and operational security all depend on the assumption that attacks require substantial human effort and expertise. If AI systems can automate the reconnaissance, phishing, and exploitation phases of an attack, the cost of attempting compromises drops dramatically while the volume of attempts scales up.
Protocols that rely on “security through obscurity” or that assume attackers will not invest the effort to map their governance structures may find those assumptions no longer hold. A system that was “secure enough” when attackers needed weeks of manual analysis might become trivially exploitable when AI can perform that analysis in hours.
This does not mean Thursday’s attacks were AI-assisted. There is no evidence either way in the available disclosure. But the broader trend line suggests that the window for fixing governance and key management vulnerabilities is narrowing. Attacks that are currently expensive and time-consuming to execute may become cheap and automatable within years, or even months.
The Bridge Security Problem Has No Easy Fix
Cross-chain bridges occupy an awkward position in crypto’s security model. They exist because different blockchains cannot natively interact with each other, so someone has to build a translation layer. That translation layer inherently requires trust assumptions that individual chains do not.
A Bitcoin transaction settled on the Bitcoin blockchain benefits from the cumulative proof-of-work of the entire network. A “Bitcoin” on an Ethereum bridge benefits only from the security of that specific bridge contract and the governance structure behind it. The bridge operators could be five people with a multisig. The verification logic could have a bug. The upgrade authority could be compromised.
This trust-assumption gap explains why bridges have become the preferred target for large-scale crypto thefts. They concentrate value in ways that individual user wallets do not. They often have governance structures that are simpler to compromise than attacking an entire blockchain. And they frequently suffer from the same classes of vulnerabilities because bridge design remains genuinely hard.
Some industry participants have argued for standardized bridge security audits, insurance requirements, or regulatory frameworks. Others contend that the only real solution is to build native interoperability into blockchain protocols themselves, eliminating the need for bridge layers. Neither approach has gained sufficient traction to prevent the ongoing parade of exploits.
Verus’s decision to redeposit funds into a bridge that had already been exploited through a known vulnerability class represents either extraordinary confidence or extraordinary carelessness. The fact that neither the protocol nor its users caught the continuing exposure before attackers did suggests that current audit and monitoring practices remain insufficient.
The $35 million lost Thursday will not be the last bridge exploit. The question is whether the industry will eventually develop governance structures, insurance mechanisms, or architectural alternatives that make these attacks prohibitively difficult, or whether bridges will remain crypto’s weakest structural link indefinitely.
For users holding assets in cross-chain protocols, the lesson from Thursday’s events is painfully clear: the value you deposit is only as safe as the humans who control the keys and the logic that verifies withdrawals. Neither has proven reliable.
