Two Ethereum bridges lose $31.69M in attacks; B² halts token rewards

Two Ethereum-connected bridges lost a combined $31.69 million within hours of each other, and a third protocol, B² Network, suspended token staking after detecting unauthorized access to its upgrade authority.

The AFX bridge on Arbitrum took the first hit. Blockaid flagged the exploit at 21:30 UTC on July 22. A single Arbitrum transaction moved 24.15 million USDC out of the bridge operated by AFX, a decentralized trading protocol. AFX immediately suspended its USDC custody bridge and stressed that the incident was isolated to a third-party bridge, not its own trading infrastructure, mainnet, or Arbitrum's native bridge.

In preliminary findings published July 24, AFX blamed a "coordinated social engineering and infrastructure compromise." The attackers appeared to start in a development environment, then infiltrated internal build infrastructure and validator systems. AFX said it is verifying balances, pursuing fund recovery, and preparing remediation. As of July 24, it had not announced any completed return of funds or a finalized compensation plan.

Hours after the AFX incident, an Ethereum transaction showed the Verus bridge releasing 1,137.45 ETH plus seven token transfers. Blockaid valued the unbacked payouts at about $7.54 million. SlowMist's analysis found that the bridge approved eight withdrawals without proof that matching assets backed them. The firm linked the failure to the same broad cross-chain import-validation class as a May exploit but said the two attacks used different mechanics.

B² Network's incident was not a bridge exploit. The network said someone gained unauthorized access to its staking contract's upgrade authority. B² suspended normal staking during security reviews, said the issue was contained, and promised full compensation to affected users. No restitution had been documented as of July 24. B² also offered a manual unstaking route: users can request withdrawal through its official Discord, with ownership-verified requests processed within one business day. The network did not disclose a loss amount, so that incident is excluded from the $31.69 million bridge-loss total.

The three events hit during a period of heightened scrutiny on cross-chain infrastructure. For traders, the immediate watch items are AFX's balance verification and any compensation plan, and whether B² resumes normal staking or extends the manual exit process. The Verus bridge exploit also raises questions about how many other deployments rely on the same import-validation logic.