DeFi loses $35M in a day: Are ‘bounties’ inviting more hacks?

An ongoing hacking spree has claimed another three victims in the past 24 hours, with a total of over $35 million lost.

Verus bridge has lost over $7.5 million, just two months after being hit by a similar hack which claimed $11 million. Proceeds of the May exploit were partially returned following a 25% bounty offer.

Now, AFX is offering a 30% bounty in response to losing $24 million USDC from its Arbitrum bridge.

In an increasingly bleak landscape for legitimate security researchers, such generous offers are, at best, insulting, and, at worst, may even tempt those with such skills to the dark side.

May 17: Verus Bridge hacked for 5402.4 ETH.https://t.co/cnio3JaQfo

May 21: The attacker returned 4052.4 ETH.
(25% bounty, retards)https://t.co/EOIv0Q7Eum

July 8: Verus Bridge put the money back in the Verus Bridge.https://t.co/tezGITBfCR

July 22: Verus Bridge hacked for… https://t.co/1oLWeiLxhp pic.twitter.com/AX0znCMctC

— Tay (@tayvano_) July 23, 2026

Verus bridge hacked again

Following the return of 75% of the funds lost in May’s hack, the assets were sent from the recovery address back into the Verus bridge just 14 days ago.

In the early hours of Thursday, a wide range of assets (tBTC, ETH, USDC, scrvUSD, MKR, USDT and EURC) totaling $7.5 million were withdrawn from the bridge in a single transaction.

According to blockchain auditor SlowMist, both exploits share a root cause of “flawed cross-chain import validation,” though with slightly different attack vectors.

This time it looks much less likely that Verus will see the money again, however. The attacker has since deposited a total of 3,916 ETH (over $6.6 million) to Tornado Cash.

AFX’s USDC bridge drained of $24M

Late on Wednesday, AFX’s USDC custody bridge on Arbitrum was drained of over $24 million. Security firm BlockSec believes this to be a “malicious use of authorized validator keys,” which were used to sign “the bridge’s 5-of-7 validator quorum.”

Responding to the incident, AFX stated it had suspended bridge operations and is “investigating the root cause.”

It reassured users that its “AFX trading infrastructure, mainnet, and the Arbitrum network itself have not been compromised.”

AFX has also offered a 30% bounty, worth $7.2 million, for the return of the remaining funds, “as a white hat bounty.” Security expert Taylor Monahan, again, questions the wisdom of such a move.

We are extending a white hat settlement offer to the party responsible for the recent bridge incident.

Return 70% of the stolen assets to the following address:
0x222Bd8dbc0d71972f880DAb5D69cdCFD903D9f1B

You may retain the remaining 30% as a white hat bounty.

Our priority is…

— Ken / Supercube (@supercubeguy) July 23, 2026

Another audit firm, Peckshield, notes that the exploiter has since swapped the funds for over 12,000 ETH, worth approximately $24 million. Funds remain in the attacker’s address on Ethereum.

Since the beginning of last week, bridge exploits have claimed at least $40 million.

BSquared staking contract emptied

Finally, BTC-for-AI-agents project BSquared was hacked for almost $4 million due to “unauthorized access to the staking contract’s upgrade authority.”

The team has promised affected B2 stakers will be fully compensated, and is offering the standard 10% bounty.

There may have been an exploit involving @BSquaredNetwork on BNB Chain.

The attacker drained 8.591M $B2 tokens worth $3.86M, swapped them for 5,409 WBNB ($3.11M), bridged the funds to Ethereum, and is currently moving them to Zcash via NEAR Intents.

Theft addresses:… pic.twitter.com/fnLnAPKxtI

— Specter (@SpecterAnalyst) July 22, 2026

The contract was drained of $3.86 million worth of B2 tokens on BNB Chain. According to blockchain investigator Specter, which flagged the theft, the tokens were swapped to WBNB, bridged to Ethereum and moved to privacy protocol Zcash.

They claim that the privileged role has been active for over a year, which may point to an inside job.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post DeFi loses $35M in a day: Are ‘bounties’ inviting more hacks? appeared first on Protos.