Thirty-five and a half million dollars. Gone in less than 24 hours, across three separate crypto bridge attacks that hit AFX Trade, BSquared, and VerusCoin in quick succession. Blockchain investigators confirmed the figure and noted that each exploit used a completely different method, which makes the day's damage harder to write off as a single coordinated campaign.
What happened to each protocol
AFX Trade took the first blow. Details on the exact vulnerability are still being pieced together, but funds moved off the platform rapidly, a pattern investigators now associate with automated draining scripts. BSquared followed, with attackers apparently targeting a flaw in how the bridge validated cross-chain messages. VerusCoin rounded out the trio, and its exploit stood apart technically from the other two. In all three cases, the stolen assets were already in motion within minutes of the breach, routed through mixing layers before most users even noticed something was wrong.
The timing raised eyebrows. Three bridge failures on the same day, even with different mechanics, points to a broader structural problem: cross-chain infrastructure remains the softest target in DeFi. Bridges hold pooled liquidity and, by design, have to trust external data sources, which creates attack surface that single-chain protocols simply don't carry. With regulators already watching DeFi vault structures more closely, incidents like this add pressure on builders to harden security before compliance conversations even begin.
What the funds trail looks like now
Most of the $35.6 million had already moved by the time on-chain analysts published their first reports. The attackers used a combination of bridges, privacy tools, and decentralized exchanges to fragment the trail. Recovery at this stage is unlikely without cooperation from centralized off-ramps, and none of the three projects had announced any exchange freeze requests at the time of writing.
- AFX Trade: funds routed through multiple intermediary wallets within minutes of the exploit
- BSquared: cross-chain message validation flaw identified as the likely entry point
- VerusCoin: attack vector distinct from the other two, investigation ongoing
The three incidents together put July 2025 on track to be one of the heavier months for DeFi losses this year. Bridge hacks have historically accounted for the largest single-incident losses in the space, and this day alone confirms the trend hasn't reversed.
This article is for informational purposes only and does not constitute financial advice or a recommendation to buy, sell, or hold any asset.
