AFX/Verus Bridge Hacks: If Native Bridges Are Safe, Why Were They Exploited?

Over $35 million in assets were drained in a series of cross-chain bridge hacks within just 24 hours. With both AFX Trade and the Verus bridge being hit, some of you might be worried about the security of the Ethereum or Arbitrum networks themselves. Let's break down the facts behind these incidents and explain why such issues keep occurring in 'intermediate middleware' rather than the main blockchains.

AFX Trade's $24.15 Million Drain: A Lapse in Key Management

The hardest hit was AFX Trade, a decentralized futures exchange on Arbitrum. Approximately $24.15 million in USDC was drained from the bridge it operated for asset custody. Looking into the cause, this wasn't a technical flaw in the blockchain itself, but a 'key leakage' issue—more of a failure in operational management.

The bridge was designed to require signatures from at least 5 out of 7 external validators to authorize withdrawals. However, the attacker managed to obtain these signing keys, easily meeting the threshold and making the theft appear like a legitimate withdrawal. The stolen assets were immediately transferred to the Ethereum network and converted into 12,467 ETH.

It is crucial to clarify one thing here: while many were concerned that the Arbitrum network itself had been compromised, Arbitrum's official native bridge remained perfectly safe and functional. The security breach occurred solely within the custom-built bridge created by the project itself. AFX has currently suspended the bridge and is attempting to recover the funds by offering a 30% bounty to the attacker.

Verus Bridge: Asset Drain Due to Code Vulnerabilities

Only a few hours after the AFX incident, another bridge hack occurred between Verus and Ethereum, resulting in a loss of about $7.54 million. Unlike the key theft at AFX, this incident was caused by a vulnerability in the smart contract code itself.

The gap the hacker exploited was simpler than expected. Cross-chain bridges are generally designed to release assets on one chain only after a deposit on the other chain is verified. By abusing a logical error in the deposit verification phase, the attacker was able to withdraw assets from the Ethereum side without actually depositing anything.

What is particularly unfortunate is that this same bridge suffered a similar exploit last May, resulting in losses of approximately $11.58 million. Because this type of damage could have been prevented with more thorough security patches and follow-up management, the project has faced significant criticism from the community regarding its security standards.

Native Bridges Are Safe: The Culprit is 'Middleware'

When we hear news of bridge hacks, it's natural to fear that something has gone wrong with the blockchain networks themselves, like Arbitrum or Ethereum. But the reality is quite different. Think of it like this: the postal service package is sturdy and secure, but the private delivery service moving the items mid-way is where the security breach occurred.

Arbitrum's official native bridge was working safely without any issues during this incident as well. The real culprit wasn't the official path, but the middleware bridges built independently by the projects. Hackers know that the core blockchain, which is extremely secure, is difficult to attack, so they target the relatively weaker third-party verification systems.

Due to these security threats, the industry is increasingly turning its attention to native transfer technologies directly supported by asset issuers, such as Circle's Cross-Chain Transfer Protocol (CCTP). These allow for the safe movement of assets without relying on complex intermediate validators or middleware.

Impact on the Local Market and Regulations

This series of hacks has once again highlighted how vulnerable self-built external middleware bridges can be.

Consequently, domestic financial authorities and the banking sector—which prioritize stability above all else—are likely to become even more cautious about adopting permissionless public bridges. In the future, domestic institutions will likely prioritize highly controlled private payment networks or verified native transfer standards like Circle’s CCTP over third-party bridges that carry high security risks.

As users, we should also get into the habit of double-checking whether we are using official native bridges when moving assets between blockchains, or if we are relying on bridges built individually by specific projects.