Analyzing the $35.6M Triple Bridge Exploit: Lessons for DeFi Yield Farmers

Three bridge exploits on July 22, 2026 drained a combined $35.6 million in under 24 hours, according to CryptoRank's incident summary. AFX Trade on Arbitrum lost $24.15 million in USDC, the BSquared Network bridge lost roughly $3.86 million in B2 tokens, and VerusCoin's Ethereum bridge lost $7.54 million across ETH, tBTC, USDC, USDT, DAI and other assets. For yield farmers routing capital across chains, these are three independent attack vectors landing in the same window — the structural signal matters more than the headline number.

Three failure modes, one day

The exploits did not share a root cause. That is the data point worth holding.

AFX — validator compromise. Blockaid detected the exploit at 21:30 UTC and attributed the drain to AFX's bridge-specific withdrawal path. The bridge approved a 24.15 million USDC withdrawal using five of seven validator signatures, indicating the attacker either obtained validator keys or breached the bridge's backend. Stolen USDC was moved from Arbitrum to Ethereum within the same operational window.

BSquared — liquidity abuse on a thin market. The attacker extracted 8.59 million B2 tokens, immediately sold into 5,409 BNB (~$3.01 million), and routed proceeds to Ethereum. From there the funds moved through NEAR Intents and HOT Protocol — two services purpose-built to fragment transaction graphs. The exploit worked not because of a validator or contract bug, but because the B2 token's market depth was low enough for the attacker to cash out without meaningful slippage.

VerusCoin — unpatched code. SlowMist confirmed the attacker reused the same import-path contract bug from a prior $11.5 million VerusCoin bridge exploit in May 2026. The flaw permitted unbacked payouts: the bridge released assets without verifying that the sending chain had actually locked the corresponding funds. Proceeds were converted into 3,916 ETH and sent to Tornado Cash. A known bug, a public precedent, a second drain.

What this means for deployed capital

We see three distinct primitives failing in parallel: cryptographic key custody, market microstructure on low-liquidity bridged tokens, and unaudited or unremediated contract code. Any yield strategy that touches a wrapped or bridged asset inherits all three surfaces simultaneously. Bridge risk is no longer a single category — it is a stack of unrelated failure modes that share only the threat model "value crosses chains."

The VerusCoin case is the cleanest lesson: a publicly documented exploit in May did not produce a code fix that prevented the same drain in July. For protocols citing audits or prior incident reports as risk mitigants, that gap between disclosure and remediation is now the primary attack vector. AFX illustrates the opposite case — the contract logic may have functioned as designed; the breach was operational, in the validator layer. BSquared shows that even where code and keys are intact, a token the protocol itself minted can become the exit liquidity.

Funds across all three incidents are already laundered or in active rotation through mixing services. Recovery, based on the trail as reported, is unlikely.

Verdict

Treat AFX, BSquared, and VerusCoin bridge exposure as impaired until each team publishes a post-mortem with verifiable remediation. For active positions: withdraw bridged assets to native chains where the underlying yield source remains solvent, and price the remaining bridge risk against the APY being earned. The premium for staying bridged after a cluster like this is negative. Capital preservation now beats yield compression — the math is binary, and it does not favor holding.