DeFi loses $35M in a day: Are ‘bounties’ inviting more hacks?
An ongoing hacking spree has claimed another three victims in the past 24 hours, with a total of over $35 million lost.
Verus bridge has lost over $7.5 million, just two months after being hit by a similar hack which claimed $11 million. Proceeds of the May exploit were partially returned following a 25% bounty offer.
Now, AFX is offering a 30% bounty in response to losing $24 million USDC from its Arbitrum bridge.
In an increasingly bleak landscape for legitimate security researchers, such generous offers are, at best, insulting, and, at worst, may even tempt those with such skills to the dark side.
Read more: Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week
Verus bridge hacked again
Following the return of 75% of the funds lost in May’s hack, the assets were sent from the recovery address back into the Verus bridge just 14 days ago.
In the early hours of Thursday, a wide range of assets (tBTC, ETH, USDC, scrvUSD, MKR, USDT and EURC) totaling $7.5 million were withdrawn from the bridge in a single transaction.
According to blockchain auditor SlowMist, both exploits share a root cause of “flawed cross-chain import validation,” though with slightly different attack vectors.
This time it looks much less likely that Verus will see the money again, however. The attacker has since deposited a total of 3,916 ETH (over $6.6 million) to Tornado Cash.
Read more: Bridge hacks back in vogue as Verus exploit brings 2026 total to $329M
AFX’s USDC bridge drained of $24M
Late on Wednesday, AFX’s USDC custody bridge on Arbitrum was drained of over $24 million. Security firm BlockSec believes this to be a “malicious use of authorized validator keys,” which were used to sign “the bridge’s 5-of-7 validator quorum.”
Responding to the incident, AFX stated it had suspended bridge operations and is “investigating the root cause.”
It reassured users that its “AFX trading infrastructure, mainnet, and the Arbitrum network itself have not been compromised.”
AFX has also offered a 30% bounty, worth $7.2 million, for the return of the remaining funds, “as a white hat bounty.” Security expert Taylor Monahan, again, questions the wisdom of such a move.
Read more: More oracle exploits as Ostium loses over $20M
Another audit firm, Peckshield, notes that the exploiter has since swapped the funds for over 12,000 ETH, worth approximately $24 million. Funds remain in the attacker’s address on Ethereum.
Since the beginning of last week, bridge exploits have claimed at least $40 million.
BSquared staking contract emptied
Finally, BTC-for-AI-agents project BSquared was hacked for almost $4 million due to “unauthorized access to the staking contract’s upgrade authority.”
The team has promised affected B2 stakers will be fully compensated, and is offering the standard 10% bounty.
Read more: Supra patched oracle on 11 other chains before $9M Hedera exploit
The contract was drained of $3.86 million worth of B2 tokens on BNB Chain. According to blockchain investigator Specter, which flagged the theft, the tokens were swapped to WBNB, bridged to Ethereum and moved to privacy protocol Zcash.
They claim that the privileged role has been active for over a year, which may point to an inside job.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.