Hackers steal $31.6M with 2 crypto bridge attacks within 7 hours

Hackers stole more than $31.6 million across two unrelated crypto bridge exploits spaced just hours apart, targeting bridges operated by decentralized perpetual exchange AFX and Verus Protocol.According to Blockaid, AFX, a decentralized perpetual exchange operating on Arbitrum, reportedly lost $24.15 million on Wednesday through a hack targeting one of its crosschain bridges. Hours later, Blockaid said it detected an exploit targeting the Verus Ethereum Bridge that resulted in about $7.5 million in crypto being stolen.The back-to-back exploits highlight the continued security risks facing crosschain bridges, which hold large pools of assets and move funds between separate blockchains.“Another bridge, another exploit. Bridges will always be a weak link, until security is upgraded,” onchain investigator TheCrypticWolf said in a post on X.AFX protocol bridge hack Blockaid said Wednesday it detected an exploit at 9:30 pm UTC targeting a bridge operated by AFX. Offchain Labs co-founder Stephen Goldfeder confirmed a bridge hack had affected a third-party protocol.“We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said in a post on X.SunSec, founder of the Web3 security community DeFiHackLabs and a contributor to SEAL, said the evidence suggested compromised keys, rather than a smart contract logic bug, were responsible for the exploit.Cointelegraph reached out to AFX for comment.Verus Ethereum bridge suffers another attackIn a separate incident, Blockaid detected an exploit targeting the Verus Ethereum bridge, leading to $7.5 million in Ether, tBTC (a Bitcoin-backed ERC-20 token), USDC, USDt, EURC, MKR and scrvUSD drained from bridge reserves.Blockaid said the attack appears similar to the previous Verus Ethereum Bridge incident in May that drained $11.58 million, using the same attack method but a different attacker wallet.“An attacker used the bridge import path to trigger unbacked Ethereum-side payouts,” said Blockaid.