Three coordinated bridge attacks resulted in $35.6M in losses; attacker wallets traced and emptied.
Security & Exploits ·
Three separate bridge exploits resulted in combined losses exceeding $35.6M across multiple protocols. The AFX bridge on Arbitrum suffered the largest single loss, with attackers draining approximately $24.2M in USDC after obtaining five signatures from a seven-validator set, suggesting a possible validator key or backend compromise. BSquared lost roughly $3.9M worth of its B2 token, which the attacker subsequently converted to BNB, bridged to Ethereum, and routed through NEAR Intents and HOT Protocol. VerusCoin's Ethereum bridge was drained for approximately $7.5M in funds that were converted to ETH and deposited into Tornado Cash.
Multiple wallet addresses have been identified in connection with each incident, including those involved in the AFX, BSquared, and VerusCoin attacks. The coordinated nature of the exploits—executed across different blockchain networks and involving varied token conversions and mixing techniques—suggests possible operational links between the incidents, though the exact relationship between the attackers remains unclear. The attacker wallets associated with the main theft addresses have since been emptied, complicating recovery efforts.