Three DeFi Exploits in Hours Expose Infrastructure Weaknesses

A separate $7.55 million exploit hit the Verus Ethereum Bridge. Researchers from Blockaid said the attacker created a forged import payload that passed cryptographic verification despite representing virtually no economic value on the originating chain. By exploiting the missing validation step, the attacker triggered unbacked payouts of assets including ETH, tBTC, and USDC on Ethereum. Blockaid said the incident followed a similar exploit disclosed in May that relied on the same underlying failure mode, raising renewed questions about economic validation within cross-chain bridge designs.

The third breach affected B² Network. Attackers gained unauthorized control of the staking contract's upgrade authority, allowing changes to privileged contract functions. The project suspended staking while security teams investigated. The protocol later said the compromise had been contained, security reviews were completed, and no additional impact on protocol funds is expected.

The three incidents, though independent, each exploited a different operational component rather than a smart contract code flaw. The attacks renewed focus on how DeFi projects secure validator keys, validate cross-chain transfers, and manage administrative access controls, researchers said. The trend suggests attackers are shifting toward off-chain infrastructure and governance systems, making those areas as critical to protect as on-chain code.