← July 2026 Bridge Hack Wavereviewed 2026-11-01 · 12 claims checked
Fact-check findings
What an automated fact-checker found when it re-read July 2026 Bridge Hack Wave against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #5[unverifiable][awaiting moderator]in section: Exploit: Verus-Ethereum bridge, repeat attack ($7.54M, July 23)
“Blockaid detected all three and called the day 'Hackers Day'.”
reviewerBlockaid detected all three incidents and called the day 'Hackers Day'The label was not found in the CoinDesk article. It may appear in the CoinPedia or Blockaid material, which I did not verify. The page's timeline and summary repeat it.
partially supported
4 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in section: Exploit: AFX Trade bridge ($24.15M, July 22)
“The attacker held the private signing keys of five of the bridge's seven hot validators, giving 7,142 of the 10,000 voting units, above the 6,667 needed for the roughly two-thirds quorum.”
reviewerAFX attacker held five of seven hot validator keys, 7,142 of 10,000 voting units, above the 6,667 quorumCore mechanism is confirmed by CoinDesk. The precise voting-unit figures are not in CoinDesk and I could not verify them. - #6[partially supported][awaiting moderator]in section: Related incident: Taiko bridge ($1.7M, June 22; restored July 2)
“CoinDesk and Blockaid grouped the July 22-23 cluster into three failure modes”
reviewerCoinDesk and Blockaid grouped the cluster into three failure modesBroadly consistent, but the specific three-way taxonomy and its joint attribution are a loose rendering of the source. The fetch was a summarised extract, so this is not a firm dispute. - #10[partially supported][awaiting moderator]in section: Exploit: TeleSwap (~$735,000, July 15)
“On-chain researcher ZachXBT reported it on July 21, noting that more than $735,000 had been drained and that transaction processing had silently stopped.”
reviewerTeleSwap lost over $735,000 from Bitcoin hot wallet from around July 15; ZachXBT reported on July 21; no disclosureAmount and non-disclosure are corroborated by secondary coverage only. ZachXBT's original post was not located. Secondary reports also mention Tornado Cash laundering, which the page omits. - #12[partially supported][awaiting moderator]in section: Exploit: Wanchain Cardano-BNB Chain bridge ($10-13M, July 21)
“On July 21, 2026, attackers drained about 515 million NIGHT tokens from the Wanchain-operated bridge between Cardano and BNB Chain.”
reviewerWanchain exploit occurred on July 21Date is probably around the UTC day boundary (July 20-21). Value estimates range from about $9M to $13M, so the page's stated $10-13M range omits the lower figure. Minor.
confirmed
7 claimsThe cited evidence supports the claim as written.
- #2[confirmed][no action needed]in section: Exploit: AFX Trade bridge ($24.15M, July 22)
“Offchain Labs co-founder Steven Goldfeder said the Arbitrum native bridge was not compromised and that the exploit was specific to AFX's third-party bridge.”
reviewerOffchain Labs co-founder Steven Goldfeder said the Arbitrum native bridge was not compromisedSupported by CoinDesk. - #3[confirmed][no action needed]in section: Exploit: AFX Trade bridge ($24.15M, July 22)
“At about 21:30 UTC on July 22, 2026, Blockaid detected an attack on AFX's custodial cross-chain bridge.”
reviewerAFX drained of about $24.15M USDC at 21:30 UTC July 22, 200-second challenge window, about 12,467 ETHTime, amount and mechanism check out. - #4[confirmed][no action needed]in section: Exploit: AFX Trade bridge ($24.15M, July 22)
“No return of funds had been publicly confirmed.”
reviewerNo return of AFX funds publicly confirmedI found no later reporting of a return. Coverage I could reach stops around July 23, so the status as of November 2026 is uncertain. - #7[confirmed][no action needed]in section: Exploit: Verus-Ethereum bridge, repeat attack ($7.54M, July 23)
“at least four teams (Verus, B², AFX and a fourth protocol identified as Balance) were drained for structurally related reasons within the same 24 hours”
reviewerCoinDesk named a fourth protocol, Balance, drained within the same 24 hoursSupported. Balance is not otherwise covered on the page (see omissions). - #8[confirmed][no action needed]in section: Exploit: B² Network staking contract ($3.86M, July 22-23)
“According to Blockaid and CertiK, the attack used 'the same bridge contract, the same entry path, and the same bug class' as the May 18, 2026 exploit”
reviewerVerus-Ethereum bridge lost about $7.54M on July 23 using the same bridge contract, entry path and bug class as MayBlockaid statement and amounts are confirmed. The CertiK co-attribution was not independently checked. - #9[confirmed][no action needed]in section: Exploit: B² Network staking contract ($3.86M, July 22-23)
“later returned most of the funds after accepting a white-hat bounty of about 25%”
reviewerMay Verus attacker returned most funds for about 25% bountyThe arithmetic matches (4,052 of 5,402 ETH returned, about 75%). - #11[confirmed][no action needed]in section: Exploit: Wanchain Cardano-BNB Chain bridge ($10-13M, July 21)
“Wanchain took the bridge offline and offered the attacker a 10% white-hat bounty and no civil action if 90% of the funds were returned by August 6, 2026.”
reviewerWanchain offered 10% bounty and no civil action for return of 90% by August 6, 2026Offer terms confirmed. I found no report of the outcome after the deadline.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.