The Verus Ethereum Bridge has suffered another exploit, with an attacker draining about $7.54 million in assets from the same contract hit in May. 

Blockchain security firm Blockaid detected the attack on Ethereum on July 23 and said the attacker used the bridge’s import path to trigger payouts that were not backed by matching assets on the source side.

The incident involved a different transaction and attacker-controlled wallet from the May breach, according to Blockaid. The firm said the new attack used the same bridge contract, entry path and apparent bug class. However, the exact root cause remained under investigation when the alert was published.

Verus bridge exploit drains multiple assets

Onchain records show the exploit transaction interacted with the Verus Ethereum Bridge contract at 03:45 UTC on July 23. The transaction transferred about 1,137 ETH and several tokens to an attacker-controlled address. The assets included tBTC, USDC, USDT, EURC, MKR and scrvUSD. Etherscan valued the main bridge outflows at roughly $7.54 million at the time.

Blockaid said the attacker abused the bridge import process to produce unbacked Ethereum-side payouts. The firm identified the receiving address as 0xCFd0…2D54 and linked the withdrawal to the same bridge contract involved in the earlier Verus incident. It has not yet published a complete technical report on the new transaction.

Additionally, the latest exploit comes about two months after the Verus Ethereum Bridge lost roughly $11.58 million in a separate attack. Security researchers said the May attacker exploited a validation gap that allowed a forged cross-chain import to pass verification even though the value committed on the source side did not match the payout released on Ethereum.

Blockaid said the July attack “appears related to the previous Verus Ethereum Bridge incident in May 2026.” It also described the two incidents as involving the “same bridge contract, same entry path, and same bug class,” although a confirmed technical cause for the latest exploit has not been released.

As crypto.news reported in May, the first Verus bridge attacker later returned 4,052.4 ETH, worth about $8.5 million at the time, after the project offered settlement terms. The attacker kept 1,350 ETH as a bounty. The returned amount represented about 75% of the funds held by the exploiter after the stolen assets had been converted into ETH.

Three exploits reported within hours

The Verus attack formed part of a broader series of security incidents reported within hours. Onchain tracker Lookonchain said AFX Trade, Verus and B² Network had suffered exploits with combined reported losses of about $35.55 million. The figures included $24.15 million from AFX, about $7.55 million from Verus and roughly $3.86 million from B² Network.

The Louisiana State Employees’ Retirement System has increased its stake in Strategy, giving the public pension fund more indirect exposure to Bitcoin through the Nasdaq-listed company.

A regulatory filing covering holdings as of June 30 shows the retirement system owned 21,300 Strategy shares, up 3.4% from 20,600 shares at the end of the first quarter. The position had a quarter-end reported value of about $1.85 million. BitcoinTreasuries.NET later valued the holding at roughly $2.13 million in a July 22 post.

Louisiana pension fund adds to Strategy position

The latest disclosure shows that the Louisiana State Employees’ Retirement System added 700 MSTR shares during the second quarter. The fund previously held 20,600 shares as of March 31, according to institutional ownership data.

BitcoinTreasuries.NET described the move by saying, “Government employees are getting BTC exposure.” However, the fund does not directly hold Bitcoin through the reported position. It owns shares in Strategy, whose balance sheet contains the largest corporate Bitcoin treasury.

The size of the retirement system has been reported using different measures. LASERS said in August 2025 that its investment assets stood at $16.3 billion. Its official history page says the total market value of assets reached $17.2 billion for the fiscal year ending June 30, 2025. The MSTR position therefore accounts for only a small part of the overall portfolio.

LASERS administers 24 retirement plans covering more than 150,000 members and their families. Its broader portfolio includes traditional equities and other asset classes, meaning the Strategy holding represents one listed equity position rather than a direct allocation of pension assets into Bitcoin.

MSTR offers indirect exposure to Strategy’s Bitcoin treasury

Strategy describes itself as a Bitcoin treasury company and uses equity, debt and other securities to finance its balance sheet. The company says its securities offer investors varying degrees of economic exposure to Bitcoin while it continues operating its enterprise software business.

The company currently holds 843,775 BTC. As crypto.news reported, the Bitcoin balance remained unchanged through July 19 while Strategy raised another $263.5 million through MSTR share sales and increased its U.S. dollar reserve to $3.225 billion.

MSTR does not track Bitcoin in the same way as a spot Bitcoin exchange-traded fund. Its price can also respond to share issuance, financing costs, corporate decisions and changes in how investors value Strategy’s Bitcoin holdings. The Louisiana fund’s position therefore gives it indirect Bitcoin-linked exposure through company stock rather than ownership of BTC itself.

The increased pension fund position also comes during a changing period for Strategy. The company reduced its Bitcoin holdings to 843,775 BTC in early July after selling some of its treasury assets under a new capital framework. Its holdings have remained at that level in subsequent disclosures. As previously reported, the sales marked a change from Strategy’s long-running accumulation-focused approach.

Pension funds explore more routes to Bitcoin exposure

The Louisiana position comes as retirement funds and state-backed investment systems test different ways to gain crypto exposure. Some use shares of Bitcoin treasury companies or regulated investment products rather than holding digital assets directly.

Japan’s National Business Corporate Pension Fund plans to allocate about 1% of its assets to crypto through a managed multi-asset fund during fiscal 2026. The fund described the allocation as part of its currency diversification strategy.

In the U.S., states are also considering crypto-linked options for public funds. Indiana enacted legislation that opens a route for certain public retirement and savings programs to offer at least one crypto-linked investment option through self-directed brokerage services.

Meanwhile, Florida lawmakers proposed allowing selected state-controlled funds, including pension assets, to allocate up to 10% to eligible Bitcoin products and other approved digital assets. Those proposals use a different structure from Louisiana’s Strategy investment.

In addition, the Louisiana fund’s increase from 20,600 to 21,300 shares represents a modest change within a multibillion-dollar retirement portfolio. Still, the filing confirms that the pension manager maintained and expanded its position rather than exiting MSTR during the second quarter.

The move also occurred while Strategy remained the largest publicly traded corporate holder of Bitcoin. With 843,775 BTC on its balance sheet, changes in Bitcoin’s market value remain an important factor for investors holding MSTR, although the stock carries risks and characteristics separate from direct Bitcoin ownership.

Cross-chain security issues remain a major pain point for crypto markets, after investigators reported two separate bridge-related exploits occurring only hours apart. According to on-chain analytics firm Blockaid, the combined theft totaled more than $31.6 million, with funds taken from bridge infrastructure used by decentralized perpetual exchange AFX and the Verus Ethereum Bridge.

Blockaid said AFX’s bridge lost $24.15 million on Wednesday, before another attack targeting the Verus Ethereum Bridge resulted in roughly $7.5 million drained from bridge reserves. The back-to-back incidents underscore how bridge operators—and the protocols that integrate them—can be exposed even when exploits are not tied to a single chain-level weakness.

Key takeaways

• Blockaid reported losses of $24.15 million from an AFX-operated bridge on Arbitrum and about $7.5 million drained from the Verus Ethereum Bridge within hours.
• Offchain Labs co-founder Stephen Goldfeder said Arbitrum’s native bridge was not hacked, pointing to activity originating from a third-party protocol.
• Security researchers suggested the AFX incident may have involved compromised keys rather than a smart contract logic flaw.
• Blockaid said the Verus exploit appears to mirror a prior May incident, using a similar method while involving a different attacker wallet.
• Both cases highlight that bridges remain high-value targets because they custody large asset pools and move value across ecosystems.

AFX bridge exploit on Arbitrum: what was targeted

Blockaid said it detected an exploit at 9:30 pm UTC aimed at a bridge operated by AFX, a decentralized perpetual exchange running on Arbitrum. The investigation framed the event as a bridge compromise affecting a third-party integration rather than a breach of Arbitrum’s core bridging infrastructure.

According to Offchain Labs co-founder Stephen Goldfeder, a bridge hack report circulating online had impacted a transaction originating from a third-party protocol, and that the Arbitrum native bridge itself had not been exploited. Goldfeder stated that the transaction in question originated from another protocol and emphasized that Arbitrum’s native bridge “has not been hacked or exploited in any way.”

Additional analysis from SunSec, the founder of the DeFi security community DeFiHackLabs and a contributor to SEAL, suggested that the evidence pointed more toward compromised keys than toward a vulnerability in smart contract logic. While that distinction matters for incident response—key compromise typically demands urgent credential rotation and broader access review—it also signals that the weakest point may not always be the bridge contracts themselves.

Cointelegraph sought comment from AFX regarding the reported exploit, but the additional reporting available here centers on what Blockaid and affiliated investigators observed during the incident.

Verus Ethereum Bridge attack: a similar method to May

In a separate incident, Blockaid reported an exploit targeting the Verus Ethereum Bridge that drained approximately $7.5 million across multiple assets held in bridge reserves. The listed tokens included Ether (ETH), tBTC, USDC, USDt, EURC, MKR, and scrvUSD.

Blockaid said the attack method appears similar to a previous Verus Ethereum Bridge incident reported in May, which resulted in the theft of $11.58 million. In that earlier case, Blockaid said the same overall approach was used, but by a different attacker wallet.

According to Blockaid, the attacker used the bridge “import path” to trigger “unbacked Ethereum-side payouts.” In practical terms, this points to a workflow-level weakness: attackers may be able to induce the bridge to release assets on one side of the system without corresponding backing on the other side, creating a direct path to reserve depletion.

For users and integrators, the repeated nature of the tactic raises a persistent risk: even when teams patch one vulnerability, the operational mechanics of how imports and payouts are handled can remain exploitable if the underlying assumptions aren’t fully addressed.

Why bridge failures keep recurring

Bridge exploits are difficult to eliminate entirely because cross-chain infrastructure often combines multiple components: custody of assets, message passing or import/export mechanisms, and permissioning for triggering settlement flows. When attackers find a seam between those elements—whether through compromised credentials, incorrect authorization, or weaknesses in how cross-chain states are validated—the result is frequently rapid draining of funds.

On-chain investigator TheCrypticWolf summarized the broader issue in a post on X, arguing that bridges remain a weak link until “security is upgraded.” While that statement reflects a general view rather than new incident-specific evidence, the two reported attacks within the same day give it concrete support: high-value bridge reserves make the system attractive, and high complexity makes comprehensive hardening challenging.

There is also an important asymmetry across the two incidents. Blockaid’s reporting on the AFX case was paired with Goldfeder’s clarification that Arbitrum’s native bridge was not compromised, suggesting the problem lay in third-party integration or bridge controls tied to a particular protocol. In contrast, Blockaid’s description of the Verus incident emphasizes how the bridge import mechanism can lead to Ethereum-side payouts that are not properly backed—an issue that may relate more directly to settlement logic and state assumptions.

What to watch next for affected ecosystems

Bridge-related incidents typically lead to emergency measures such as pause controls, increased monitoring, and changes to custody or authorization workflows. Readers should watch for follow-up disclosures from AFX and the Verus ecosystem, especially around what Blockaid and other investigators determine about root cause—whether it’s key compromise, an authorization failure, or a repeatable weakness in import/export settlement.

More broadly, these events reinforce that cross-chain exposure isn’t limited to the bridge operators alone: decentralized applications and traders relying on bridges for liquidity and settlement should treat bridge security as a continuously evolving risk, not a one-time checkbox.

Circle has signed separate memorandums of understanding with Kakao Group and South Korean fintech operator Toss to explore stablecoin payments, blockchain settlement and digital asset infrastructure in South Korea.

The agreements bring Circle’s USDC and payment technology into discussions with some of Korea’s largest consumer finance platforms. Kakao, Kakao Pay and Kakao Bank will study opportunities around KRW-based digital assets, cross-border payments and tokenized financial services. Toss and Toss Bank will examine similar uses, including digital wallets, overseas payments and programmable onchain transactions.

Kakao Group said its agreement with Circle will combine the KakaoTalk-centered platform ecosystem with Kakao Pay’s payment services, Kakao Bank’s banking capabilities and Circle’s blockchain infrastructure. The companies plan to review payment, settlement and digital asset connectivity as South Korea develops rules for stablecoins and other tokenized financial products.

Another week, another multi-million-dollar hack in DeFi, and once again, it’s an off-chain compromise rather than a smart contract exploit.

AFX Trade, a decentralized perpetuals exchange that settles in dollar-pegged stablecoin USDC, was drained of about $24.15 million on Wednesday after an attacker compromised the validator signing keys behind a bridge the protocol operates on Arbitrum, blockchain data shows.

In other words, the smart contract did what it’s supposed to do – verify the signature and execute the transaction. The problem was with the private keys that generated those signatures, as attackers compromised the private validator signing keys (hot keys held offchain by the bridge operators or validators).

Steven Goldfeder, co-founder of Offchain Labs, which develops and maintains the network, said the Arbitrum native bridge “has not been hacked or exploited in any way” and that the transaction originated from a third-party protocol.

A hack of Arbitrum’s own bridge would signal risk across the entire layer-2 network, but a compromised protocol running on top of it is a contained failure.

Nothing in the bridge’s own code logic was broken. Bridges are blockchain-based tools for transferring tokens between various networks, including those they were not initially supported on.