KoinlyticsThree cross-chain protocols were drained of more than $35 million within a six-hour window. The perpetuals platform AFX lost roughly $24.15 million through a bridge on Arbitrum. The Verus Ethereum bridge lost about $7.54 million. B2 Network lost roughly $3.86 million.
Not one of these was a break in cryptography. Every single one was a failure of permissions, logic or key control.
The Three Failures
AFX, roughly $24.15 million
The largest of the three, drained through a bridge contract on Arbitrum. Bridge contracts hold pooled collateral backing every wrapped position on the destination chain, which makes them the highest-value single target in the entire cross-chain stack. Compromise one and you do not steal one user's funds, you steal the collateral backing everyone's.
Verus, roughly $7.54 million
The instructive one. Verus was exploited through the same contract path and the same bug class as a hack in May. The system was drained, the flaw was not fully resolved, funds were redeposited, and the attacker came back through the same door.
A repeat exploit through an identical vector is not bad luck. It means the post-incident response addressed the symptom rather than the root cause, and that users redeposited into a contract whose failure mode had been publicly demonstrated weeks earlier.
B2 Network, roughly $3.86 million
An attacker seized the upgrade authority on the staking contract. Upgradeable contracts exist so teams can patch bugs without migrating users. That same mechanism means whoever controls the upgrade key controls the contract, and by extension every asset it holds. The code did not fail. The key custody did.
The Pattern Across All Three
The common thread is that the blockchain worked exactly as designed in every case. Signatures verified. Consensus held. Hashes matched. The failures sat in the layer above:
- Contract logic that permitted withdrawals the designers did not intend
- Privileged keys held by parties who should not have had them, or held with insufficient protection
- Upgrade authority treated as an operational convenience rather than as a total control primitive
This is consistent with the year as a whole. 2026 has recorded more than $1.2 billion in losses across 276 incidents. The largest single event, the Coldcard hardware wallet exploit now above $130 million, traces to a build configuration error in a 2021 firmware release that caused seed generation to fall back on a weak software random number generator. Also not a cryptographic break. A configuration mistake.
The cryptography has held for 17 years. What keeps failing is the software around it and the humans holding the keys. Audit reports that only check the math are checking the part that works.
What This Means for Bridged Positions
A bridged token is not the asset. It is a claim against a contract that promises to release the asset. That distinction is invisible in a wallet interface, where a bridged token displays with the same name, the same icon and the same dollar value as the native one.
The practical consequences:
- Bridged balances carry the bridge's security as an additional layer on top of both chains' security
- A bridge exploit can leave wrapped tokens outstanding with no backing, which is why they typically depeg immediately rather than recovering
- Bridges that have been exploited once and patched are not automatically safer, as Verus demonstrated
- Upgradeable contracts should be evaluated on who holds the upgrade key and under what multisig or timelock, not on whether the code passed an audit
What to Watch
- Whether AFX, Verus or B2 Network publish full post-mortems naming the specific access failure
- Any recovery or negotiated return, which has become less common as attacks professionalise
- Q3 incident count against Q2's 85 events and roughly $775 million
- Whether bridges start publishing upgrade key custody arrangements as a standard disclosure
- TVL migration away from third-party bridges toward native issuance and canonical routes
If you hold wrapped or bridged assets across multiple chains, the useful exercise is enumerating them by which bridge holds the collateral, not by which chain shows the balance. Most people cannot answer that question about their own positions, and the moment it becomes urgent is the moment the answer stops being retrievable.