Attackers drained $35.55mn from three cryptocurrency protocols within 24 hours on July 22 and 23, with decentralised perpetuals exchange AFX Trade losing $24.15mn after its bridge validator keys were compromised, blockchain analytics firm Lookonchain said.

Two of the three breaches targeted cross-chain bridges, the infrastructure that moves assets between blockchains and which has become the sector's most exploited attack surface. The losses take July hack totals to roughly $97mn, according to Blockaid, ahead of the $75.32mn recorded in June.

Security firm Blockaid detected the AFX breach at 21:30 UTC on July 22. The attacker compromised the private validator signing keys authorising withdrawals from a bridge AFX operates on Arbitrum, meaning the smart contract verified the signatures and released the funds as designed. The contract treated the withdrawal as valid and paid out after a 200-second dispute period.

The stolen USDC was moved from Arbitrum to Ethereum and swapped for 12,467.5 ETH, consolidated in a single wallet, according to on-chain security firm PeckShield.

Steven Goldfeder, co-founder of Offchain Labs, which develops Arbitrum, said the network's own bridge was not affected. "We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way," he said.

AFX suspended the compromised bridge and offered the attacker a 30% bounty to return the remainder.

The Verus Ethereum bridge lost $7.55mn in a second incident, following an $11.58mn exploit in May. Blockaid said the two attacks involved the same bridge contract, the same entry path and the same class of bug.

B2 Network, a bitcoin layer-2 platform, lost $3.86mn on BNB Chain. The B2 token fell more than 15% after the exploit.

On-chain security researcher Taylor Monahan questioned why the AFX bridge held $24mn, saying a published audit showed almost no test coverage, flagged issues acknowledged but left unfixed, and auditors given only partial access to the code.