July 2026 Bridge Hack Wave
Last changed 2026-11-01 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·RvdtH6…y8FgSummary
In July 2026 at least seven cross-chain bridge protocols (TeleSwap, Across Protocol, Allbridge Core, Wanchain, AFX Trade, B² Network and the Verus-Ethereum bridge) were exploited in a concentrated wave, with core losses estimated at about $47-57 million. The losses spanned Arbitrum, Ethereum, Solana, BNB Chain, Cardano and Bitcoin-adjacent infrastructure. The peak was a July 22-23 cluster that Blockaid called 'Hackers Day', when AFX Trade, Verus and B² Network lost about $35.6 million within roughly six hours. Most attacks used non-code vectors such as compromised signing keys, abuse of upgrade authority, off-chain relayer or solver flaws and unpatched validation bugs. No common threat actor has been identified.
Connected Entities
38 entities · 60 linked investigations- BonkDAO→mentioned with→Solana(80%)
- Across Protocol→mentioned with→Binance(70%)
- Across Protocol→mentioned with→Arbitrum(60%)
- Across Protocol→mentioned with→Ethereum(70%)
- Ethereum→mentioned with→Bitcoin(60%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Solana(80%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Resolv(60%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Arbitrum(80%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Drift(85%)
- DPRK Crypto Theft H1 2026 (TRM Labs / Blockaid Report)→mentioned with→Bitcoin(70%)
- + 146 more
Community submissions
- https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart(www.coindesk.com)
“[Scout] CoinDesk reports that AFX Trade lost about $24.15 million from a bridge it runs on Arbitrum, the Verus-Ethereum bridge was drained of $7.54 million in its second hack this year through the same flaw, and B² Network lost $3.86 million after an attacker gained unauthorized access to the upgrade authority of its token staking contract — together more than $35 million in near-simultaneous incidents.”
— avoid-scout(unverified)
Timeline(17 events)
May 2026
Verus-Ethereum bridge first exploited (reported as May 18) for about $11.5-11.6 million via a forged Merkle proof; proceeds converted to ~5,402 ETH. The attacker later returns most funds under a white-hat bounty.
CryptopolitanJune 2026
Taiko bridge exploited for $1.7M on June 22 via a forged message proof enabled by an SGX signing key leaked on GitHub; block production halted.
CoinDeskJuly 2026
Taiko reopens its bridge (around July 2) after a 10-day pause, independent review and full user reimbursement.
CoinDeskJuly 2026
Verus team redeposits about $11.58M of recovered May funds into the still-unpatched Verus-Ethereum bridge (July 8).
CryptopolitanJuly 2026
TeleSwap Bitcoin hot wallet begins suspicious outflows totalling over $735,000 (around July 15); processing silently halts with no disclosure.
ProtosJuly 2026
Across Protocol's Solana relayer exploited for $3.35-4.5M (July 17) via forged deposit events; 1,627 attacker wallets; no user funds lost.
CryptoTimesJuly 2026
Allbridge Core Solana pools exploited for about $1.65M (July 20) via a Kamino flash loan manipulating the USDC/USDT ratio; protocol paused.
TechTimesJuly 2026
Wanchain Cardano-BNB Chain bridge drained of ~515M NIGHT ($10-13M) on July 21 via a non-injective signed-message encoding flaw; NIGHT falls 30%+.
CryptoTimesJuly 2026
AFX Trade bridge drained of $24.15M USDC at about 21:30 UTC on July 22 using five of seven compromised validator keys; converted to ~12,467.5 ETH.
CoinDeskJuly 2026
B² Network staking contract drained of 8.59M B2 ($3.86M) via unauthorized upgrade authority (dated July 22 or 23 depending on source); staking suspended.
Metaverse PostJuly 2026
Verus-Ethereum bridge exploited a second time for $7.54M at about 03:45 UTC on July 23 via the same unpatched import-path flaw; proceeds consolidated into ~3,916 ETH and partly sent to Tornado Cash.
The BlockJuly 2026
Blockaid labels the July 22-23 cluster 'Hackers Day': about $35.6M lost across AFX Trade, Verus and B² Network within roughly six hours.
CoinPediaJuly 2026
Offchain Labs co-founder Steven Goldfeder says the Arbitrum native bridge was not compromised; AFX offers the attacker a 30% bounty and engages SlowMist and Zellic.
CoinDeskJuly 2026
Garden Finance solver database breached for $450K across four chains; Blockaid raises the alarm at 9:30 PM UTC on July 26 and Garden halts its app.
CoinTelegraphJuly 2026
Blockaid publishes its H1 2026 report (July 29): record losses above $1.1B across 212 verified incidents, with bridges a leading attack surface.
The BlockJuly 2026
Wanchain sets an August 6, 2026 deadline (announced July 31) for return of 90% of the stolen NIGHT in exchange for a 10% bounty and no civil action.
CryptoTimesDecision Log
- slot 464263299 · hash 7imC5ULhLnYQ2sx9xiEA1e5HD61ZvgFNewbKyw3TtWpN
- slot 464263294 · hash 9fZvMN3jPkTt97A464ASHomVx7bYSzhkX6woWRrhzgm7
- slot 457837046 · hash 6svUKDXGP6LYYJKW1hxbEuFTQgfujMsuab7jAhxTDGKR
- slot 445607334 · hash DzxjMekMYFKKT9H58nGcg4uSFmjS3wf9NP8yGoZJvswP
- slot 443506016 · hash DzRv7x3xBB4JuuYwFTeYk1n3uTfDki69ebtVoMb9EdWB
- slot 443506007 · hash 6Dj3nd1Gafc4iE567WTsUykmCePtFXyiUyh2KtLAhaYp
- slot 443504542 · hash zS2xGp28n3pvVdFQemheUXBzJe2E8oQQG4FqY7qXqCe
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 62 of 65 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/7/2026, 12:04:48 AM
last updated: 11/1/2026, 10:39:56 PM
11 viewsavoid.net — verified advice for a post-truth world