DeFi loses $35M in a day: Are bounties inviting more hacks?

Summary

• Two defi bridge hack events on July 22 2026 drained over $35 million from Verus and AFX Trade
• AFX offered a white hat bounty that would let the exploiter keep 30 percent of the $24.15 million taken
• Total 2026 DeFi losses already exceed $750 million and raise fresh questions about audit standards and incentive design

Attackers drained more than $35 million from two bridges on July 22 2026. They hit the Verus Ethereum bridge for over $7.5 million. AFX Trade lost $24.15 million USDC when its keys on Arbitrum were taken.

These hits add to the $750 million already lost across DeFi this year.

Context

Cross-chain bridges hold big pools of assets. They often depend on key systems that remain hard to lock down. Both the Verus bridge and the AFX custody bridge fell to these weak points the same day.

White hat bounties now show up often after such events. AFX offered the exploiter 30 percent if they returned the rest. Past offers have recovered some funds but show no clear drop in attacks.

"Is there any chance of recovery? AFX posted a white-hat offer: return 70% and keep 30% if funds are recovered."

, Cryptodaily report (cryptodaily.co.uk)

Details

The Verus exploit followed a known pattern. Attackers used the Ethereum import path to pull the funds. The team contained the issue after that first drain.

AFX Trade faced a bigger loss when its USDC bridge keys were taken on Arbitrum. Reports show the $24.15 million moved in one sequence of transactions. The protocol chose the 70 percent bounty instead of freezes or legal steps.

No data yet ties these bounties to more frequent hacks. Observers still call for tighter audits on key storage and bridge code. Both projects had passed reviews before the losses hit.

Outlook

Teams at both protocols now work to fix the paths and restart operations. Observers will track whether the AFX offer leads to any return and whether other teams copy the approach.