Hackers steal $31.6M with 2 crypto bridge attacks within 7 hours

Hackers steal $31.6M with 2 crypto bridge attacks within 7 hours AFX, a decentralized perpetual exchange operating on Arbitrum, reportedly lost $24.15 million on Wednesday, while the Verus Ethereum bridge was attacked hours later. Hackers stole more than $31.6 million across two unrelated crypto bridge exploits spaced just hours apart, targeting bridges operated by decentralized perpetual exchange AFX and Verus Protocol. According to Blockaid, AFX, a decentralized perpetual exchange operating on Arbitrum, reportedly lost $24.15 million on Wednesday through a hack targeting one of its crosschain bridges. Hours later, Blockaid said it detected an exploit targeting the Verus Ethereum Bridge that resulted in about $7.5 million in crypto being stolen. The back-to-back exploits highlight the continued security risks facing crosschain bridges, which hold large pools of assets and move funds between separate blockchains. “Another bridge, another exploit. Bridges will always be a weak link, until security is upgraded,” onchain investigator TheCrypticWolf said in a post on X. AFX protocol bridge hack Blockaid said Wednesday it detected an exploit at 9:30 pm UTC targeting a bridge operated by AFX. Offchain Labs co-founder Stephen Goldfeder confirmed a bridge hack had affected a third-party protocol. “We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said in a post on X. SunSec, founder of the Web3 security community DeFiHackLabs and a contributor to SEAL, said the evidence suggested compromised keys, rather than a smart contract logic bug, were responsible for the exploit. Cointelegraph reached out to AFX for comment. Related: Allbridge pauses cross-chain bridge after $1.65M exploit Verus Ethereum bridge suffers another attack In a separate incident, Blockaid detected an exploit targeting the Verus Ethereum bridge, leading to $7.5 million in Ether, tBTC (a Bitcoin-backed ERC-20 token), USDC, USDt, EURC, MKR and scrvUSD drained from bridge reserves. Blockaid said the attack appears similar to the previous Verus Ethereum Bridge incident in May that drained $11.58 million, using the same attack method but a different attacker wallet. “An attacker used the bridge import path to trigger unbacked Ethereum-side payouts,” said Blockaid. Magazine: Has Bitcoin bottomed for this cycle? Analysts say ‘not yet’