Security

On July 23, 2026, three major security incidents hit DeFi. An AFX-operated USDC custody bridge on Arbitrum was exploited for $24.15 million, prompting an emergency suspension of bridge operations. The Verus Ethereum Bridge was breached for $7.55 million in a repeat of the same failure mode seen since May, while B² Network’s $B2 staking contract upgrade authority was compromised for $3.86 million and staking has been paused pending security reviews.

Balance Coin (BLC), a newly launched Bitcoin-collateralized stablecoin designed to hold a $1 peg, was hit by an oracle attack after an attacker submitted a falsely low BTC price. The manipulated price triggered liquidations across vaults, allowing the attacker to seize the BTC collateral and cash out about $912,000. BLC fell more than 99%, bottoming at $0.00075 and leaving its market value at about $2,570.

A technical bulletin said an agent runtime tied to a crypto asset (Token A) was hijacked via a malicious dependency package that attempted to transfer out an entire wallet balance. The agent itself did not detect anything abnormal. The user’s Ledger hardware signer independently decoded the transaction and displayed the real recipient address and amount, prompting the user to reject the signature. No funds were moved.

A cryptocurrency trading platform said it detected an unauthorized $98,000 withdrawal from an ephemeral instance. The platform paused all trading, deposits and withdrawals as a precaution while it conducts an investigation expected to last several hours. It said user funds remain SAFU and that the platform will cover the loss so users are not affected. The incident did not involve the mainnet or a hot wallet, but the service halt disrupts immediate token liquidity and order execution across the platform.

A report with a French-language headline said a hacker tricked a system to execute Bitcoin trades at an unusually low price of just $5,000, stealing $23.7 million. The incident points to a failure in pricing and risk controls in crypto trading or settlement. The report did not specify the platform, on-chain details, or whether any funds were recovered. It involved a large, abnormal BTC fill and systemic fraud, dealing a direct blow to trust in the spot market.

Between 14:46 and 14:55 UTC on July 22, 2026, Wanchain’s official bridge lock address on the Cardano side was drained, with about 515M NIGHT moved out—roughly 97% of the bridge’s 527M NIGHT reserves. The funds were routed through newly created wallets and more than 290M NIGHT were quickly sold on Cardano DEXs, sending the token down about 50%. Only NIGHT was affected and other bridged tokens were left untouched; on BNB, wNIGHT is now severely undercollateralized and redemptions are effectively broken.

An incident involving Wanchain’s Cardano-to-BNB cross-chain bridge has disrupted normal use of bridged NIGHT tokens. An official statement said the issue appears to stem from bridge operations rather than the Midnight Network mainnet itself. The team said it is monitoring the situation with relevant partners as it works to verify the facts. No loss amount, affected addresses, or recovery timeline has been disclosed, and users were urged to watch for phishing or impersonation scams.

On July 13, the BTC+ smart contract on BNB Smart Chain was attacked after the deployer private key was compromised, allowing an upgrade to the minting proxy and the creation of unauthorized BTC+. The team said it completed an emergency response within three hours, isolating the malicious contract and freezing, burning, or quarantining all unauthorized tokens while confirming the underlying BTC remains secure. Subscriptions and redemptions have been temporarily paused pending a final security review, with redemptions expected to resume within two weeks. BTC+ is issued only through official Solv channels and has no official liquidity pool on any DEX.

A post alleged that a Base-chain project executed another rug pull in under 24 hours, wiping users’ assets. It also said traders are rotating into a Solana-based token themed on an animal that went viral on TikTok. The post framed the episode as a repeat security failure that undermines trust in Base as Ethereum’s Layer 2 infrastructure. It added that the shift toward high-risk meme tokens on Solana could amplify short-term volatility and liquidation risk, with knock-on effects for Base-native assets and Solana on-chain liquidity.

Hackers issued an ultimatum to Kenya’s State House, demanding a Ksh41 Million ransom paid in Bitcoin (BTC) by 18:00 on 2026-07-19. They threatened to leak a large cache of classified state secrets if the payment is not made. The incident is in Kenya and targets the country’s top executive office. The ransom is denominated in fiat but must be settled in BTC.