Crypto Bridges Are Still Breaking: Inside 2026’s Hack Wave

In April 2026, a single exploit against the restaking protocol KelpDAO’s LayerZero bridge deployment drained close to $292 million and put cross-chain bridges back at the center of crypto’s security conversation, as CoinDesk detailed at the time. That was the kind of hack that gets a name, a retrospective, and a promise that the industry has learned something. Then the headlines moved on.

They should not have. Between June 22 and July 23, 2026, at least six more cross-chain bridges were exploited: Taiko, Allbridge Core, Wanchain’s Cardano bridge, AFX Trade, BSquared Network, and VerusCoin’s Ethereum bridge, the last one hit for a second time in just nine weeks. None of these hacks reached nine figures. Most barely made a single news cycle outside crypto-native outlets. Together they tell a more useful story than any single mega-hack can: bridge security in 2026 is not really improving, the targets are simply getting smaller, newer, and less scrutinized, even as total value locked in cross-chain infrastructure keeps climbing with every new rollup and appchain that launches its own bridge.

A Wave Nobody Priced In

Crypto audit firm PeckShield put 2026’s running total for bridge-specific losses at roughly $329 million as of late May, according to Protos, and that figure was almost entirely one incident: KelpDAO’s $292 million loss accounted for the overwhelming majority, leaving the other seven tracked incidents at around $39 million combined. Read that way, 2026 looked like a story about one catastrophic misconfiguration, not a systemic problem.

Then came the five weeks that followed. Add up Taiko’s roughly $1.7 million, Allbridge Core’s $1.65 million, Wanchain’s roughly $10 million, AFX Trade’s $24.15 million, BSquared Network’s $3.86 million, and VerusCoin’s second $7.54 million hit, and another $49 million in bridge losses appeared in barely more than a month, pushing 2026’s running total past $375 million even before anyone updates the official tally. Protos also noted that bridge hacks dominated 2022’s security headlines, with roughly $1.9 billion lost across six major incidents that year, before attackers seemingly rotated toward social engineering and supply chain compromises for a while. The summer of 2026 looks like bridges are back in favor with attackers, just at a different scale.

Bridges in Three Sentences

A cross-chain bridge exists because no blockchain can natively read another chain’s state. Something, a federated multisig, a network of external validators, an optimistic fraud-proof window, or a light client verifying cryptographic proofs, has to vouch that an event really happened on the source chain before the destination chain mints, releases, or unlocks the matching value. Every hack in this piece comes down to attackers finding a way to make that vouching mechanism say yes when it should have said no, whether by stealing the keys that sign off, feeding it a malformed message it fails to reject, or draining a badly configured liquidity pool instead of touching a mint function at all.

In practice, that vouching mechanism takes one of a handful of forms. A federated multisig has a fixed group of parties sign off on each transfer, simple to build but only as safe as the independence of its signers, the exact weakness Ronin exposed in 2022 when one company effectively controlled a majority of the signing set. An external validator or attestation network, the model behind Wormhole’s guardians or LayerZero’s decentralized verifier networks, spreads that trust across more independent parties but still requires enough of them to agree, and to agree correctly, on what happened elsewhere. Optimistic designs assume messages are valid unless someone proves otherwise within a challenge window, trading speed for reliance on someone actually watching and disputing bad messages in time. Light client and zero-knowledge designs try to remove the trust question entirely by having the destination chain mathematically verify a cryptographic proof of the source chain’s state, at the cost of being harder to build and slower to extend to new chains. Every bridge examined below falls into one of the first three categories. None of them had adopted the fourth.

July 22 to 23: Three Bridges, One Bad Stretch

Three of the six hacks in this wave landed within about a day of each other. On the night of July 22, an attacker compromised the validator signing keys behind a bridge run by the Arbitrum-based perpetuals venue AFX Trade and walked away with $24.15 million in USDC, according to CoinDesk. In the same stretch, BSquared Network lost roughly $3.86 million in its native B2 token after an attacker gained unauthorized control of a staking contract’s upgrade authority, per Metaverse Post. And VerusCoin’s Ethereum bridge, already hit for $11.58 million in May, was drained again for $7.54 million using the same class of vulnerability, CryptoTimes reported, this time by a different attacker altogether.

None of these three protocols runs anywhere near the transaction volume of a Wormhole or a LayerZero. That is precisely the point: the attention, audit budgets, and bug bounty programs that hardened the biggest bridges after incidents like KelpDAO have not trickled down to the long tail of smaller, newer, or app-specific bridges that keep shipping the same categories of bugs.

AFX Trade: When the Keys Are the Vulnerability

AFX Trade operates a perpetuals exchange on Arbitrum that settles positions in USDC, and like many app-specific DeFi protocols, it runs its own bridge rather than relying solely on Arbitrum’s native one. On July 22 at 21:30 UTC, an attacker who had somehow obtained the offline private signing keys used by the bridge’s validators produced five valid signatures, enough to meet the roughly two-thirds quorum the bridge required to authorize a withdrawal, CoinDesk reported. The contract enforced a 200 second dispute window meant to give someone time to flag a fraudulent withdrawal before funds moved, but 200 seconds was nowhere near enough to catch a withdrawal that looked procedurally valid because it carried real, correctly signed keys. The contract released 24.15 million USDC, nearly the entirety of AFX’s total value locked. The attacker bridged the funds to Ethereum and swapped them for roughly 12,467 ETH, consolidating everything into a single wallet.

Offline, or cold, key storage is supposed to be the safer option; the premise of keeping signing keys away from any internet-connected system is that remote attackers cannot simply reach in and grab them. AFX’s incident is a reminder that offline does not mean unreachable: keys still have to be used by people, on devices, inside a process that can be phished, socially engineered, or compromised through an insider, the same broad category of failure that let Lazarus Group operatives compromise a Sky Mavis engineer at Ronin through a fake job offer back in 2022. CoinDesk’s reporting did not specify exactly how AFX’s validator keys were obtained, but the fact that five separate signatures were produced, enough to clear a two-thirds quorum among validators who are supposed to be independent of each other, suggests either a shared point of compromise across multiple signers or a single custodian responsible for more keys than the quorum design assumed.

Arbitrum co-founder Steven Goldfeder moved quickly to draw a line around the damage, stating that Arbitrum’s own native bridge “has not been hacked or exploited in any way,” per the same CoinDesk report. That distinction mattered for Arbitrum’s reputation, but it did not help AFX’s users: the vulnerability lived in a bridge AFX operated on top of Arbitrum, not in the underlying network, which is exactly the kind of distinction that is invisible to a user who just sees funds gone, regardless of which layer actually failed.

BSquared Network: An Upgrade Key With Too Much Power

BSquared Network, a Bitcoin layer 2 project, lost 8.59 million of its native B2 tokens, worth about $3.86 million at the time, after an attacker gained unauthorized access to the upgrade authority controlling its staking contract, according to Metaverse Post. Whoever controls an upgrade key on a proxy contract can, in effect, rewrite what that contract does, and here it was used to redirect staked tokens to the attacker instead of legitimate stakers. The attacker sold the entire haul for 5,409 BNB, worth about $3.01 million, then routed the proceeds toward Ethereum and laundered through NEAR Intents on a path toward Zcash, a privacy-focused chain that keeps turning up as an off-ramp in recent stolen-funds cases.

Upgradeable proxy contracts are common in DeFi precisely because immutable code is unforgiving of bugs: if a team ships a flaw in a contract that can never change, the only fix is a full migration asking every user to move funds to a new contract, a slow and trust-eroding process. An upgrade authority solves that by letting a designated key push a new implementation without moving any funds. The tradeoff is that the upgrade authority itself becomes as valuable a target as the funds it protects, since compromising one key can be equivalent to compromising the entire contract’s logic. Security reviews of upgradeable contracts increasingly focus as much on who holds upgrade rights and how those keys are secured as on the logic of the contract being upgraded, and BSquared’s incident suggests that focus has not yet become universal practice.

BSquared’s response followed a script that is becoming familiar: the team suspended B2 staking pending a security review and publicly offered the attacker legal immunity in exchange for returning part of the funds. An upgrade key is a convenience most teams build in so they can patch bugs quickly. It is also, as this incident shows, a single point of failure that turns a smart contract audit into a trust exercise about whoever happens to be holding that one key.

VerusCoin: Hit Twice in Nine Weeks by the Same Bug

VerusCoin’s Ethereum bridge is the clearest case in this wave of a lesson not being learned the first time. In May 2026, an attacker bypassed a safety check called checkCCEValues and drained roughly $11.58 million, a bug that, per DeFi Planet’s reporting, could have been closed with around ten additional lines of Solidity code. That episode had what looked like a happy ending: the attacker later returned about $8.5 million under a negotiated white hat arrangement.

It did not end there. On July 23, the same bridge was drained again, this time for $7.54 million, through what CryptoTimes described as the same import path weaponized against the protocol in May, but carried out by an entirely different attacker working from a fresh wallet. The second attacker swapped the stolen assets for ETH and began laundering through Tornado Cash, the mixer the U.S. Treasury’s Office of Foreign Assets Control sanctioned in 2022 and then delisted in March 2025 after a Fifth Circuit ruling found OFAC had exceeded its authority targeting immutable smart contracts. VerusCoin has not issued a public statement about the second hack.

There is a specific, uncomfortable mechanic behind cases like this: publicly disclosing that a vulnerability existed, even after a fix ships, can itself signal to other attackers that the same code, if deployed elsewhere or patched only partially, might still be exploitable. Whether that is exactly what happened here is not confirmed; VerusCoin has not said how the second attacker found the same import path. But the nine-week gap and the shift to a fresh wallet are consistent with a second, unrelated party reading the public postmortem of the first hack and testing whether the underlying issue had actually been closed everywhere it needed to be, rather than just in the specific transaction path the first attacker used. Two exploits of the same vulnerability class within nine weeks, on a bridge that had already paid for it once, is about as direct a data point as this sector produces on how rarely a postmortem changes what actually ships to production.

Wanchain’s Cardano Bridge: A Parsing Bug With a Bounty Clock

Wanchain’s bridge to Cardano, which handles the NIGHT token associated with the privacy-focused Midnight network, was exploited on July 20. CoinDesk’s reporting put the drain at roughly 290 million NIGHT tokens, though the dollar value has been reported inconsistently across outlets, from around $10 million in CryptoTimes’ initial report to higher estimates elsewhere. The root cause was a parsing bug: the bridge’s TreasuryCheck validator concatenated 14 variable-length redemption fields into a single byte string with no delimiters between them, which meant different combinations of field values could produce an identical byte string, and therefore an identical hash and a reusable signature. It is the kind of bug a fuzzer or a careful code review might catch, and the kind that is easy to miss precisely because it does not look like a security check at all, it looks like ordinary serialization code.

NIGHT’s price fell about 43% to an all-time low before rebounding close to 19% within 24 hours, trading around $0.022 as the immediate panic passed, per CoinDesk. Cardano founder Charles Hoskinson used the moment to make a broader argument, telling CoinDesk that “all software is under this enormous assault” from automated, AI-assisted vulnerability discovery, and comparing bridge security to disease resistance: “that’s like being 90% resistant to a deadly disease. If you’re exposed to it enough, eventually you still catch the disease.” He also pushed back on coverage that focused only on the crash, noting that outlets “magically forget to mention the rebound.” His preferred fix is structural rather than incremental: replacing trust in bridge operators and multisigs with zero-knowledge proof systems like Midnight, the same proving-without-revealing logic this outlet examined in the context of verifiable AI computation, so a receiving chain can mathematically confirm what happened on the source chain instead of trusting a validator set to report it honestly.

As of this writing, Wanchain has given the attacker until August 6, 2026 at 12:00 UTC to return 90% of the stolen tokens in exchange for keeping the remaining 10% and avoiding civil claims, according to CryptoTimes. The clock is still running.

The Outlier: Taiko’s Ten-Day Recovery

Not every bridge hack in this wave ended badly. Taiko’s layer 2 Ethereum bridge was exploited on June 22 for about $1.7 million after an SGX (Intel Software Guard Extensions) signing key was accidentally exposed in a GitHub repository, letting the attacker forge withdrawal proofs and drain both the bridge and its ERC20 Vault, as CoinDesk reported. What happened next is the part worth remembering: Taiko patched the vulnerability, refilled its reserves one to one, commissioned an independent security review, and reopened the bridge on July 2, just ten days after the exploit. The team said every affected user was made whole, and the TAIKO token rose a striking 136% in the aftermath, seemingly rewarding the speed and transparency of the response rather than punishing the hack itself.

Taiko’s episode is a useful counterweight to the rest of this list. It shows a fast, well-communicated recovery can limit reputational damage even after a real loss, and it is a reminder that whether a protocol got hacked is a less useful question for evaluating a bridge than how that protocol responded afterward.

Allbridge Core: The Postmortem It Did Not Follow

Allbridge Core offers the starkest illustration in this wave of a lesson management failed to apply everywhere it should have. On July 19, an attacker used a $1.12 million flash loan from the Solana lending protocol Kamino to manipulate the ratio inside one of Allbridge’s USDC and USDT liquidity pools, draining about $1.65 million, according to CryptoTimes. Allbridge paused Core, asked the arbitrageurs involved to return their profits, confirmed its separate Allbridge Next product was unaffected, and announced that Core and its older Classic product would shut down entirely within three months, to be replaced by a design routed through Circle’s CCTP and LayerZero instead of pooled liquidity.

The mechanics of a flash loan attack on a liquidity pool are almost mundane by crypto standards at this point: borrow a large sum with no collateral, provided it is repaid within the same transaction, use it to push a pool’s internal price or balance ratio far from where arbitrageurs would normally keep it, execute a trade or redemption at that distorted ratio, then repay the loan and keep the difference, all atomically and in seconds. It works specifically against pools holding more than one asset in a fixed relationship, such as Allbridge’s paired USDC and USDT liquidity, because a large enough single-transaction trade can temporarily overwhelm the pool’s own pricing logic before any external actor has a chance to react. A single liquidity pool per chain, the fix Allbridge says it built after 2023, closes this specific door by removing the paired-asset ratio a flash loan needs to manipulate in the first place.

Here is the detail that sets this case apart from the others: this was Allbridge’s second time losing money to nearly the identical attack. In April 2023, Allbridge’s BNB Chain pools were drained of roughly $570,000 to $650,000 through the same flash loan and pool-ratio manipulation technique. The team recovered about $465,000 through a white hat negotiation at the time and publicly committed to a fix: one liquidity pool per chain, a Rebalancer Authority, and automatic shutdown triggers. Per CryptoTimes’ reporting, that fix was never extended to the Solana deployment, which kept running side-by-side USDC and USDT pools, precisely the configuration the 2023 postmortem said had been eliminated. Whatever Allbridge learned in 2023 stayed on one chain.

The 2026 Bridge Hack Ledger

Laid out together, the wave’s basic facts are easier to compare than scattered across separate news cycles.

Then and Now: Why the Targets Got Smaller

Two things are true about bridge hacks in 2026, and they point in different directions. The first is that the ceiling on a single loss has clearly not come down: KelpDAO’s April exploit, at nearly $292 million, sits closer in scale to the giants of 2021 and 2022 (Ronin’s $625 million, Poly Network’s $611 million, Wormhole’s $325 million) than to anything in the summer wave. The second is that below that top tier, the typical incident has gotten much smaller and much more frequent. The table below breaks out the arithmetic.

Read one way, this looks like progress: the biggest, most battle-tested bridges took their lessons from KelpDAO seriously, and attackers responded by moving down market to bridges with thinner security budgets. Read another way, it looks like the same unsolved problem wearing a smaller price tag. Vitalik Buterin’s long-standing critique of cross-chain design, that “there are fundamental limits to the security of bridges that hop across multiple ‘zones of sovereignty,’” as he put it in a widely cited 2022 thread, applies just as well to a $1.65 million Solana liquidity pool as it does to a $625 million multisig. The trust assumption is the same size problem regardless of how much value sits behind it; only the consequences scale with the number attached.

Hoskinson’s answer, replacing that trust assumption with zero-knowledge proofs rather than patching it incident by incident, is a structural argument rather than an operational one, and it is not obviously compatible with every existing bridge design without a costly rebuild. It is also not a new idea: light client and zero-knowledge verification schemes have existed alongside federated multisigs and external validator networks for years, and they remain a minority of deployed bridge value precisely because they are harder to build and slower to ship than a simple trust-this-validator-set design. Every hack in this wave happened on a bridge that chose the faster option.

Where the Stolen Money Goes

Follow the money across this wave and a pattern repeats: none of the attackers appear to have simply held their stolen tokens. AFX Trade’s attacker immediately swapped 24.15 million USDC for roughly 12,467 ETH and consolidated everything into a single wallet, a first step that still leaves funds fully traceable on a public ledger. BSquared’s attacker sold the stolen B2 tokens for BNB, moved the proceeds to Ethereum, and began routing them through NEAR Intents toward Zcash, a privacy-focused chain that shields transaction details once funds actually enter it. VerusCoin’s second attacker took the simplest route available: swap for ETH, then Tornado Cash, the same category of mixer previously implicated in laundering proceeds from other major bridge hacks.

The throughline is that the moment of maximum traceability is also the moment closest to the theft itself. While a stolen asset sits in a single wallet on a transparent chain like Ethereum or Arbitrum, on-chain analytics firms and exchange compliance teams have their best shot at freezing or flagging it, the kind of scrutiny this outlet has examined in the compliance stack built by major venues, including in its comparison of Coinbase, Binance, Kraken, and OKX for institutional traders. Every hour that passes without a freeze increases the odds funds reach a privacy chain or a mixer, at which point recovery becomes a matter of getting the attacker to negotiate voluntarily rather than one of blockchain forensics tracing a wallet in real time. That is precisely why the gap between exploit and public disclosure matters almost as much as the security design that failed in the first place; Taiko’s ten-day full recovery and VerusCoin’s silence sit at opposite ends of that same clock.

Bounty Diplomacy Becomes the Default Playbook

Wanchain’s ultimatum (keep 10%, return 90%, or face pursuit) and BSquared’s offer of legal immunity for a partial refund are not improvised responses. They follow a playbook that goes back to Poly Network’s 2021 hack, when the protocol addressed its attacker directly as Mr. White Hat, offered a $500,000 bounty and a symbolic chief security advisor title, and recovered almost the entire $611 million within about two weeks. A white hat bounty works because it changes the attacker’s calculation: laundering tens of millions of dollars in stolen crypto without getting caught is hard and slow, while negotiating a 10% cut with a public assurance of no criminal referral is fast and comparatively safe, provided the protocol is credible about following through.

Not every team gets to run this playbook. VerusCoin’s silence after its second hack stands out precisely because Wanchain and BSquared both moved fast and in public. A credible bounty offer requires a functioning team, treasury reserves to make good on its promises, and a public profile that the attacker’s own standing among other hackers depends on trusting. Smaller or newer projects sometimes have none of the three, which is one reason the same category of exploit produces such different outcomes depending on which protocol it happens to hit. For users trying to judge how much they might get back after a hack, a protocol’s public communication style turns out to be a more useful signal than its market capitalization.

What Actually Reduces Bridge Risk

None of the six 2026 incidents in this piece required a user to do anything wrong. The people who lost money were simply holding assets on the wrong side of a bridge when it broke. That makes generic caution close to useless as advice, but a few structural questions do correlate with risk before the fact, drawn from what actually failed in each case above.

• Validator or signer threshold: how many independent signatures does a withdrawal need, and are they genuinely run by separate parties, or does one entity, as at Ronin, effectively control a majority on its own?
• Dispute or finality window: is there meaningful time for a fraudulent withdrawal to be flagged before funds move, and is that window long enough to matter, given that AFX Trade’s 200 seconds clearly was not?
• Audit history and scope: has the specific bridge contract, not just the underlying chain, been audited, and do the audits cover upgrade authorities and key management rather than just token logic?
• Bug bounty size relative to total value locked: a bounty program that caps out far below what a successful exploit would net gives an attacker little reason to report responsibly instead of simply draining the pool.
• Track record under stress: has this bridge or team been exploited before, and if so, was the underlying flaw actually fixed everywhere it was deployed, or only on the chain that got hit first, the way Allbridge’s history shows?

None of these questions are exotic. They resemble the same due diligence that separates a reputable centralized exchange from a thinly regulated one, the kind of gap this outlet walked through when comparing how quickly Coinbase, Binance, Kraken, and OKX get a new user through compliance checks during onboarding. The uncomfortable difference is that connecting a wallet to a bridge typically involves none of that friction. There is no KYC step, no custody agreement, and often no obvious way for an ordinary user to check a validator threshold or a dispute window without reading a contract or a technical postmortem.

Some of the largest bridges have already made structural changes along these lines. In the wake of the KelpDAO incident, several major cross-chain messaging networks raised their minimum verification requirements so that no single operator or verifier can approve a transfer alone, and a portion of the value that used to flow through single-verifier configurations has since shifted toward networks requiring larger, more diverse sets of independent operators. None of that history helps a user evaluating a bridge that only launched this year and has no incident, or fix, to point to yet. For those bridges, the checklist above is close to the only due diligence available. Bridges remain the part of crypto’s infrastructure where the least user friction coexists with the highest concentration of unrecoverable risk, and the summer of 2026 suggests that gap has not closed, it has just moved to a new set of protocols.

Frequently Asked Questions

Why do cross-chain bridges keep getting hacked?

Bridges concentrate enormous value behind a small number of validator signatures, oracle messages, or smart contracts that must vouch for events on a chain they cannot natively verify. Newer or smaller bridges often launch with thin audit budgets and low validator thresholds, so attackers gravitate toward the weakest link in a fast-growing field of new deployments rather than the hardened giants that have already been forced to raise their defenses.

Which crypto bridges were hacked in July 2026?

Within about two weeks, Allbridge Core (July 19), Wanchain’s Cardano bridge (July 20), AFX Trade on Arbitrum (July 22), BSquared Network (July 23), and VerusCoin’s Ethereum bridge, hit for a second time in the same window, were all exploited for amounts ranging from roughly $1.65 million to $24.15 million.

What is a white hat bounty in a crypto hack?

A white hat bounty is an offer from a hacked protocol letting an attacker keep a percentage of the stolen funds, commonly around 10%, in exchange for returning the rest and avoiding a criminal or civil pursuit. Wanchain and BSquared Network both used this approach in July 2026, following a pattern set by Poly Network’s 2021 hack.

Is it safe to use a cross-chain bridge in 2026?

Bridges remain one of the riskier categories in crypto because they combine smart contract risk with validator, key management, and off-chain infrastructure risk all at once. Checking a bridge’s validator threshold, its dispute or finality window, its audit history, and its total value locked relative to its bug bounty size gives a rough read on exposure before moving funds across one.

What is the biggest cross-chain bridge hack in history?

The Ronin Bridge hack in March 2022 remains the largest at roughly $625 million, narrowly ahead of Poly Network’s 2021 loss of more than $610 million, almost entirely returned, and the 2026 KelpDAO exploit at close to $292 million.

Daniel Voss covers security and infrastructure for HOGE Wire.