Two Ethereum cross-chain bridges were drained of a combined $31.7 million within hours of each other on July 25, 2026, and a third protocol paused staking to limit further exposure, according to a report from CryptoSlate. The incidents land during an already jittery week for crypto, with Bitcoin trading at $63,959 (down 1.7% on the day as of July 25, 2026) and the Fear & Greed index sitting at 35, firmly in "Fear" territory.
Bridges have become the single most reliably exploited piece of crypto infrastructure, and this week's losses fit a pattern that has repeated for years. The specific protocols and the exact exploit paths are still being confirmed by on-chain analysts at the time of writing. What is already clear is the shape of the problem: money that moves between chains passes through contracts holding large pools of pooled liquidity, and those pools are a concentrated target.
Concentrated liquidity is the weak point
A bridge works by locking assets on one chain and issuing a representation of them on another. To do that, it has to hold the underlying tokens somewhere, usually in a single set of smart contracts. That design creates one large, addressable balance instead of many small ones. An attacker who finds a flaw in the minting logic, the signature verification, or the message-passing layer does not steal from individuals one at a time. They drain the whole reserve at once.
That is why a relatively modest headline figure like $31.7 million can still force a third, unrelated protocol to hit pause on staking. When one exploit surfaces, teams running similar architecture have to assume the same class of bug could apply to them. Halting deposits, withdrawals, or staking is the standard defensive move while engineers audit their own contracts. It is a rational response, but it also freezes user funds mid-flight, which is its own kind of loss.
A recurring failure mode, not a one-off
This is not new. Cross-chain infrastructure has bled hundreds of millions across separate incidents, and 2026 alone has produced a steady drumbeat of them. The VerusCoin Ethereum bridge was exploited for $7.54 million in unbacked payouts, the AFX bridge lost $24.15 million in USDC, and the Allbridge Core team paused its bridge after a flash loan drain. Different teams, different codebases, same category of failure.
The common thread is that bridges combine three hard problems at once: they hold large balances, they rely on off-chain validators or relayers to attest that events happened, and they run minting logic that must never issue more tokens than are actually locked. A bug in any one of those layers can break the peg between the wrapped asset and its backing. Once that peg breaks, the wrapped token is only worth what someone will pay for it, which is often close to nothing.
The takeaway if you hold assets across chains
For anyone who routes funds between networks, the practical takeaway is about where your money sits, not just what it is worth. A balance parked in a bridge contract, or held as a wrapped token that depends on a bridge staying solvent, carries a risk that a balance in your own wallet does not. If a bridge is exploited or freezes withdrawals, the timing of when you can move is no longer your decision.
This matters for crypto card users too. Cards that let you spend directly from your own wallet settle against assets you control on a single chain, avoiding the extra hop through a bridge. Custodial card products carry a different but related concern: if the provider holds your balance and faces its own solvency event, your funds can be frozen the same way a bridge freezes them. The FTX and Wirecard collapses are the reference points there. Neither model is risk-free, but they fail in different ways, and knowing which failure you are exposed to is the point.
A few habits reduce the blast radius. Keep only what you plan to move inside a bridge, and move it promptly rather than parking it there. Prefer holding native assets on their home chain over wrapped versions when you do not need the wrapped form. And treat a protocol's decision to halt staking or withdrawals as information, not just an inconvenience: it usually means the team sees a credible threat and is choosing to freeze rather than risk a drain.
Overview
Two Ethereum bridges lost a combined $31.7 million within hours on July 25, 2026, and a third protocol halted staking to contain the fallout, per CryptoSlate. The specific protocols and exploit paths are still being verified. The episode repeats a well-worn pattern: bridges concentrate liquidity in a small number of contracts, which makes them a high-value target and turns a single bug into a full-reserve drain. For users, the lesson is about custody and timing. Assets held in your own wallet on a single chain avoid the extra trust assumptions that bridges and wrapped tokens introduce, and a staking halt is best read as an early warning rather than a temporary annoyance.
