TL;DR
- An exploit focusing on AFX Commerce, a perpetuals trade on Arbitrum, drained $24.15 million from its USDC custody bridge.
- The protocol provided the attacker the choice to maintain 30% of the stolen funds as a “white hat bounty” if the remaining 70% is returned.
- The Verus-Ethereum bridge suffered a second exploit in two months, leading to losses of $7.54 million by way of the identical vulnerability that was exploited in Might.
An exploit on a number of fronts shook the DeFi ecosystem, with two assaults that triggered losses exceeding $31 million in a matter of hours. AFX Commerce, a decentralized trade for perpetual contracts on Arbitrum that settles in USDC, was drained and misplaced $24.15 million after an attacker compromised the custody bridge operated by the protocol itself. Blockchain safety agency Blockaid confirmed the incident. AFX famous that the precise assault vector stays beneath investigation.
The on-chain path documented by PeckShield reveals that the attacker transformed the stolen USDC into 12,468 ETH, property that have been concentrated in a single pockets. AFX suspended bridge operations instantly and clarified that the vulnerability was “remoted to the custody bridge operated by AFX” and couldn’t have an effect on the protocol’s buying and selling infrastructure or the Arbitrum community. Steven Goldfeder, co-founder of Arbitrum, was fast to publicly make clear that the community’s native bridge “was not hacked or exploited in any means.”
#PeckShieldAlert @AFX_XYZ on #Arbitrum has been exploited for ~$24M USDC. The exploiter has bridged the stolen funds from #Abitrum to #Ethereum and swapped them for 12,467.5 $ETH, at the moment sitting in 0x6276…ebAC.https://t.co/INZ7ZxtRhE pic.twitter.com/fUHFfEn1F5
— PeckShieldAlert (@PeckShieldAlert) July 23, 2026
Exploits as Negotiating Foreign money
Hours after the incident, Ken C, AFX’s head of progress, revealed a direct provide to the attacker: return 70% of the funds and hold the remaining 30% as a “white hat” bounty. The tactic isn’t new within the crypto business; Drift Protocol on Solana tried an analogous negotiation after shedding $285 million in an exploit in April.
The second assault of the day focused the Verus-Ethereum bridge, which misplaced roughly $7.54 million by way of the identical class of vulnerability exploited in Might. In keeping with Blockaid, the attacker abused the bridge’s import path to generate unbacked funds on the Ethereum facet, draining ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD earlier than changing all the things into ETH. CertiK estimated losses at $7.53 million and confirmed that the funds have been deposited into Twister Money.
#PeckShieldAlert @BSquaredNetwork on #BNBChain has been drained of 8.591M $B2 (value ~$3.86M).
The exploiter swapped the stolen funds for over 5K $WBNB, then swapped them to 1,128 $ETH and bridged out by way of NEAR Intents. $B2 has dropped -15%. pic.twitter.com/S7qWobFLJ9
— PeckShieldAlert (@PeckShieldAlert) July 23, 2026
What deepens the gravity of the case is that this second assault used the identical contract, the identical entry path, and the identical class of vulnerability because the Might exploit, although with a unique attacker working from a new pockets. The earlier incident had triggered losses of $11.6 million, although the attacker returned 4,052 ETH after retaining 25% as a bounty.
Is immediately Hackers’ Day?
Three exploits have already occurred immediately, with whole losses of $35.55M.
AFX Commerce(@AFX_XYZ) was exploited for $24.15M.
Verus(@VerusCoin) Ethereum bridge was exploited for $7.55M.
B² Community(@BSquaredNetwork) was exploited for $3.86M. pic.twitter.com/9v1KxWtaHV
— Lookonchain (@lookonchain) July 23, 2026
Lastly, lower than an hour later, PeckShield reported that attackers drained 8.59 million B2 tokens from BSquaredNetwork on BNB Chain, leading to losses of roughly $3.86 million. The hackers shortly swapped the tokens for greater than 5,000 WBNB, then transformed them into 1,128 ETH earlier than bridging the funds out by way of NEAR Intents
Each assaults add to the listing of a devastating 12 months for decentralized finance, which has gathered greater than $840 million in losses from hacks throughout 2026.
