In a brutal 24-hour window this July, three separate DeFi bridges—Verus, AFX, and BSquared—were drained of over $35 million. The victims are not random; they share a DNA of broken trust and governance shortcuts. Each attack exploited a failure mode we’ve seen before: flawed validation logic, compromised signing keys, and overprivileged admin contracts. But the real story isn't the code—it’s the culture that let these vulnerabilities persist.
Context: The Protocol Landscape
These bridges are not experimental; they are production-grade infrastructure connecting major L1s like Arbitrum and BNB Chain. Verus relied on a custom ‘cross-chain import verification’ mechanism—a design that SlowMist audited and flagged. AFX used a 5-of-7 validator multisig, where attackers misused authorized signing keys to approve malicious messages. BSquared, a Bitcoin Layer2, gave a single admin the power to upgrade its staking contract—a privilege that was accessed without authorization.
All three represent a common architectural mistake: centralizing security assumptions while marketing themselves as ‘trustless.’ The real trust lies in the hands of a few keys or a few lines of code. When those fail, the bridge fails.
Core: The Technical Autopsy
Let’s start with Verus. In May, hackers stole funds using a defective cross-chain import logic. The team recovered 75% via a 25% bounty—a move that should have triggered a full rebuild. Instead, they patched the surface. Two months later, the same root cause reappeared. The code audit had identified the issue, but the fix was cosmetic. This is not a technical failure; it’s a governance failure. The team prioritized speed over security, assuming the first attack was a fluke.
AFX’s attack is simpler but more damning. The 5-of-7 validator model is a classic multisig, but the keys were clearly compromised. PeckShield traced the exploit to a malicious signing session. This isn’t a zero-day—it’s a key management disaster. When you give seven entities the power to move millions, you need hardware security modules, multi-party computation, and strict rotation policies. AFX had none of that.
BSquared’s case is the most troubling. The attacker gained ‘unauthorized access to the staking contract upgrade privilege’—a phrase that should terrify any rational investor. Spencer, a detective, noted that ‘the privileged role has been active for over a year, suggesting insider involvement.’ This is the nightmare scenario: a trusted developer or operator turning rogue. The attacker extracted 859.1 million B2 tokens (worth $3.86 million) and dumped them on PancakeSwap, crashing the price.
Based on my experience auditing DeFi protocols for the past seven years, these attacks are not sophisticated zero-days but textbook failures of operational security. The code is often sound enough for a single-use case, but the surrounding infrastructure—key management, upgrade control, audit follow-through—is abandoned to expedite launch.
Contrarian: The Bounty Fallacy
Here’s where the industry narrative gets dangerous. These bridges offered bounties: Verus gave 25% for the May return, AFX proposed up to 30% for the July hack. The standard praise is that bounties encourage white-hat disclosure. But look closer. In Verus’s case, the bounty didn’t prevent a second attack; it merely bought a temporary peace. The same actors (or copycats) realized they could exploit again and negotiate. Taylor Monahan, a security expert, questioned the wisdom: ‘Are these bounties inviting more hacks?’ The evidence says yes.
A 30% bounty is effectively a ransom floor. It tells attackers, ‘You will get paid for your crime, as long as you return part of the loot.’ This blurs the line between ethics and extortion. In traditional finance, we call this a hostage negotiation. In crypto, we dress it up as ‘community recovery.’ The result is a perverse incentive: exploit, negotiate, profit. The industry will soon face regulatory scrutiny—OFAC has already sanctioned Tornado Cash, and these bounty-linked recoveries could be construed as aiding money laundering.
We need to trust the protocol, not the pitch. The pitch says ‘bounties align incentives.’ The protocol says ‘you have no credible defense against repeat attacks.’ Silence is the loudest audit.
Takeaway: The Human-Centric Verdict
These three hacks are not an exception; they are a symptom. DeFi has prioritized TVL over resilience, and it shows. The fix is not better smart contracts—it’s better governance. Projects must adopt hard time locks for upgrades, rotate keys using multiparty computation, and submit to continuous audits. More importantly, they must stop using bounties as a crutch. If you design a system that can be exploited twice by the same method, you don’t need a bounty—you need a rebuild.
Code doesn’t lie, but the people who deploy it do. Trust the protocol, not the pitch. And remember: silence is the loudest audit.