Hackers steal $31.6M in 2 crypto bridge attacks within 7 hours
Hackers stole more than $31.6 million across two unrelated crypto bridge exploits spaced just hours apart, targeting bridges operated by decentralized perpetual exchange AFX and Verus Protocol.
According to Blockaid, AFX, a decentralized perpetual exchange operating on Arbitrum, reportedly lost $24.15 million on Wednesday through a hack targeting one of its crosschain bridges. Hours later, Blockaid said it detected an exploit targeting the Verus Ethereum Bridge that resulted in about $7.5 million in crypto being stolen.
The back-to-back exploits highlight the continued security risks facing crosschain bridges, which hold large pools of assets and move funds between separate blockchains.
“Another bridge, another exploit. Bridges will always be a weak link, until security is upgraded,” onchain investigator TheCrypticWolf said in a post on X.
AFX protocol bridge hack
Blockaid said Wednesday it detected an exploit at 9:30 pm UTC targeting a bridge operated by AFX. Offchain Labs co-founder Stephen Goldfeder confirmed a bridge hack had affected a third-party protocol.
“We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said in a post on X.
SunSec, founder of the Web3 security community DeFiHackLabs and a contributor to SEAL, said the evidence suggested compromised keys, rather than a smart contract logic bug, were responsible for the exploit.
Cointelegraph reached out to AFX for comment.
Related: Allbridge pauses cross-chain bridge after $1.65M exploit
Verus Ethereum bridge suffers another attack
In a separate incident, Blockaid detected an exploit targeting the Verus Ethereum bridge, leading to $7.5 million in Ether, tBTC (a Bitcoin-backed ERC-20 token), USDC, USDt, EURC, MKR and scrvUSD drained from bridge reserves.
Blockaid said the attack appears similar to the previous Verus Ethereum Bridge incident in May that drained $11.58 million, using the same attack method but a different attacker wallet.
“An attacker used the bridge import path to trigger unbacked Ethereum-side payouts,” said Blockaid.
Magazine: Has Bitcoin bottomed for this cycle? Analysts say ‘not yet’
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.