Over the past 24 hours, three separate bridge protocols lost over $28 million—and one of them lost funds twice to the same flaw. Headlines will scream about rising crime, about the inadequacy of bug bounties, about DeFi's failure to protect capital. But tracing the quiet resilience beneath the market reveals something more worrying: these attacks were not clever. They were lazy. They targeted the same centralised weak spots that the industry has known about for years. The question is not whether bounties invite hacks. The question is whether we are willing to redesign the infrastructure itself.
Context: The Anatomy of Three Failures
On July 24, 2024, a chain of events unfolded in rapid succession. The Verus bridge, a cross-chain messaging protocol connecting Ethereum to BNB Chain, lost roughly $230,000 after a hacker exploited its cross-chain import validation logic. This was the second time Verus was hit by the same root cause—the first attack in May had prompted a 25% bounty offer, and the hacker returned 75% of the stolen funds. But the underlying flaw was never truly fixed. Two months later, the same backdoor was forced open.
Minutes later, the AFX bridge lost $24 million. Attackers used unauthorized access to a 5-of-7 multi-signature validator set, signing malicious transactions that drained its liquidity pools. The protocol immediately paused operations and offered a 30% bounty for the return of assets. Security auditor BlockSec identified the breach as a compromise of validator keys—not a novel cryptographic attack, but a failure of key management.
Then came BSquared. Its B2 staking contract was upgraded—without authorisation—allowing the attacker to mint 8.59 million B2 tokens worth $3.86 million, which were promptly swapped on PancakeSwap. The project later announced a compensation plan for affected stakers, but the damage was done. On-chain analysis by PeckShield revealed that a privileged role had been active for over a year, potentially pointing to an insider threat.
Total losses from these three events: $28.1 million. Combined with earlier 2024 bridge attacks, the year-to-date figure now exceeds $329 million.
Core: The Structural Failure Behind the Numbers
When I audited Ripple‘s XRP Ledger in 2018 for enterprise banking partners, I learned a simple lesson: security is not a feature you bolt on after launch. It is the foundation you build upon. Yet here we are in 2024, seeing protocols that treat security as a reactive PR exercise. The Verus bridge is the clearest example. After the May hack, the team likely patched the specific exploit path but failed to redesign the core validation logic. The result: a second attack that exploited the same foundational assumption—that imported cross-chain data could be trusted without rigorous proof-of-work or zero-knowledge verification. This is not innovation. It is negligence.
The AFX and BSquared cases point to a different but equally dangerous failure: the concentration of control. A 5-of-7 multi-sig in a bridge means that any three compromised keys can halt or drain the protocol. In practice, many teams store these keys on centralized servers, inside hot wallets, or worse, with a single administrator. The AFX attack shows that the threat surface extends beyond the code to the operational security of key custodians. Specter's investigator noted that the privileged role in BSquared had been active for over a year. That is not a quick exploit. That is a sleeping giant—a backdoor that someone had been monitoring, perhaps an insider or a long-term threat actor.
From a market perspective, the damage is not just the stolen funds. It is the second-order effects. BSquared's B2 token was dumped immediately, cratering its price and exposing shallow liquidity. The broader bridge sector faces a crisis of confidence. Capital rarely returns to a burned bridge—especially not when the same bridge burns twice.
Contrarian: The Bounty Mechanism Is Not the Villain
The media narrative is converging on a convenient scapegoat: the bounty mechanism. The article itself questions whether bounties are “inviting more hacks.” Taylor Monahan, a prominent security researcher, expressed scepticism about the wisdom of offering 25-30% for returns. The argument is intuitive: if you pay hackers to give back stolen funds, you incentivize future theft. But this view ignores the reality of bridge security today.
Bounties are a symptom, not a cause. They are what desperate teams reach for when they have no other recourse. The true failure is that these protocols were designed with single points of failure—validators that can be compromised, contracts that can be upgraded without governance, authentication that can be bypassed. A bounty is simply the admission price for this structural fragility.
Moreover, the bounty system has a place when paired with robust governance. In my work with the European Securities and Markets Authority in 2024, we discussed the need for standardised white-hat protocols: clear rules, community vote before payment, and mandatory cooperation with law enforcement. The Verus and AFX bounties were opaque, decided behind closed doors. That is the real problem. Transparency and due process can turn bounties from ransom into restitution.
Consider the alternative: no bounty. The hacker keeps 100% of the funds, launders through Tornado Cash (as the Verus attacker did), and the project absorbs a total loss. At least with a bounty, some funds return. But the better path is to make bounties irrelevant by building bridges that can't be hacked in the first place. Until then, blaming bounties is like blaming the ambulance for the car crash.
Takeaway: Positioning for the Next Cycle
The chop market of 2024 is not a time for yield chasing. It is a time for positioning. These attacks tell us where capital will flow when the next bull run begins: away from centralised bridges and toward trust-minimised alternatives like ZK-rollup native bridges, LayerZero's immutable endpoints, and decentralized light clients. The infrastructure layer is being reshaped, and the old multi-sig bridges are becoming dinosaurs.
For investors: look at protocols that have undergone multiple independent audits, have time-locked admin keys, and offer insurance funds. For builders: integrate continuous monitoring from firms like SlowMist and PeckShield—not as a marketing badge, but as a living practice. For users: if a bridge has been exploited once, do not return until you see a publicly verifiable rearchitecture.
Payments rails cannot be built on foundations of sand. The quiet resilience beneath the market is the movement toward verifiable, decentralized security. It is happening slowly, but the data confirms it. The bridges that survive will be the ones that treat security as a structure, not a bounty.