Three DeFi protocols lost a combined $35 million on July 23, 2026, with Verus Bridge and AFX accounting for the bulk of the damage in what is shaping up to be one of the worst single-day stretches for cross-chain infrastructure this year.

Verus hit twice, same flaw

Verus Bridge was drained of $7.5 million worth of assets, including tBTC, ETH, USDC, MKR and EURC, in a single transaction in the early hours of Thursday. The timing is brutal: the funds only returned to the bridge 14 days ago, after the attacker from May's $11 million hack sent back 75% of the stolen ETH following a 25% bounty offer. Blockchain auditor SlowMist confirmed both exploits share the same root cause, "flawed cross-chain import validation," though the attack vectors differed slightly.

Recovery looks unlikely this time. The attacker has already routed 3,916 ETH, worth over $6.6 million, through Tornado Cash.

Security researcher Taylor Monahan summed it up bluntly on X: the bridge deposited the recovered funds back into the same vulnerable contract, and two weeks later it was gone again.

AFX loses $24M, offers $7.2M to get it back

Late Wednesday, AFX's USDC custody bridge on Arbitrum was drained of just over $24 million. Security firm BlockSec attributed the incident to "malicious use of authorized validator keys" used to sign off on the bridge's 5-of-7 validator quorum. AFX suspended bridge operations and said its trading infrastructure and the Arbitrum network itself were unaffected.

The protocol then offered a 30% bounty, $7.2 million, for the return of the remaining 70%. PeckShield noted the exploiter has since begun swapping the stolen funds.

The bounty approach is drawing sharp criticism. Monahan and others argue that offering thieves a multi-million dollar cut normalizes the behavior and, at worst, gives skilled security researchers a financial incentive to go rogue rather than report vulnerabilities through legitimate channels. The 2026 bridge hack total now stands at $329 million.

This article is for informational purposes only and does not constitute financial advice.