Three hacks in 6 hours: DeFi protocols lost $35.55M in a single day

Three separate attacks on DeFi protocols hit within a six-hour window on July 23, 2026, with combined losses topping $35.55 million, CoinDesk reports. None of the attacks broke the underlying cryptography — each was either a logic flaw in the code or a compromised key.

Three attacks, three different mechanisms

• AFX Trade (Arbitrum): the attacker compromised the validator signing keys behind the protocol's bridge, bypassing the required quorum, and drained $24.15 million in USDC — then swapped it for 12,467.5 ETH.
• VerusCoin (Ethereum bridge): $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD were drained through a logic flaw in asset-backing verification — the same vulnerability already exploited in May ($11.5 million lost), with funds returned to the bridge on July 8 stolen again two weeks later.
• B² Network (bitcoin scaling): $3.86 million in B2 tokens were drained via unauthorized access to the staking contract's authority; the project halted staking and pledged full reimbursement for those affected.

Who caught the attacks

Blockaid detected and publicly flagged the AFX Trade and VerusCoin attacks in real time; the B² Network theft was traced by Lookonchain, which followed the stolen tokens as they were converted into ETH and stablecoins.

Part of a bigger wave

Counting a fourth, smaller attack on the Balance protocol (~$1 million), total losses for the day reached roughly $36 million. According to CryptoTimes, cumulative hack losses for all of July 2026 have climbed to nearly $97 million. We covered a similar bridge exploit last week — Wanchain, where attackers drained 515 million NIGHT tokens in just 8 minutes.

This article is for informational purposes only and does not constitute investment advice.