Market

Coldcard Suspected of Facing a Fourth Organized Attack Wave

A significant security vulnerability in the popular Coldcard hardware wallet has resulted in the theft of approximately 1,367 Bitcoin, valued at nearly 89 million dollars, from thousands of users. According to on-chain analysis by Galaxy Research, the losses span 4,585 addresses across multiple waves of attacks that began in late July 2026. The largest single wave occurred on July 30, when attackers drained 1,082 Bitcoin in just 41 minutes.

The root cause is a firmware bug dating back to March 2021. Coldcard devices are designed to generate wallet recovery seeds using a hardware-based random number generator for strong entropy. However, certain firmware versions contained an integration error that caused the system to fall back to a software-based random number generator. This software generator relied on predictable inputs, including the chip serial number and system clock values, significantly reducing the randomness of the generated seeds.

As a result, the number of possible seed combinations became far smaller than intended. Attackers were able to calculate potential seeds offline and scan the Bitcoin blockchain for matching addresses that still held funds. Once identified, the private keys could be reconstructed and the Bitcoin moved without any physical access to the wallets or connection to the internet by the victims. Many of the affected wallets had remained dormant for years, belonging to long-term holders who believed their cold storage setup was secure.

Coinkite, the Canadian company behind Coldcard, issued an official security advisory after the issue came to light. The company confirmed that seeds generated on certain firmware versions of the Mk2, Mk3, and some later models are at risk if they were created without sufficient additional entropy such as multiple independent dice rolls or a strong unique passphrase. Fixed firmware versions have been released for all affected models. However, Coinkite has clearly stated that updating the firmware alone does not secure existing seeds. Users must generate an entirely new seed on an updated or unaffected device and carefully transfer their funds.

Rodolfo Novak, CEO of Coinkite, has publicly acknowledged the company’s responsibility for the flaw. The incident has sparked widespread discussion in the Bitcoin community about the limitations of single-signature hardware wallets and the importance of layered security practices. Security experts continue to recommend multi-signature setups that distribute risk across multiple devices from different manufacturers as a more robust approach to self-custody.

Anyone who generated a seed phrase on a Coldcard device from March 2021 onward should review the official Coinkite advisory and take immediate steps to migrate their Bitcoin to a newly generated seed if their setup matches the vulnerable criteria. The episode serves as a reminder that even trusted cold storage solutions can contain long-hidden software issues, and that ongoing vigilance remains essential for protecting digital assets.

PayBox x MoonPay get free USDC

MoonPay has officially introduced PayBox a new product designed to make cryptocurrency transactions simpler through artificial intelligence. The launch has attracted significant attention in the crypto community especially after many users reported receiving free USDC rewards during the initial promotion period.

MoonPay is a well established fintech company founded in 2019 that specializes in on ramp and off ramp services. These services allow users to easily buy and sell cryptocurrencies such as Bitcoin Ethereum and USDC using traditional payment methods. The company has raised substantial funding including a major investment from Tiger Global that valued MoonPay at 3.4 billion dollars. More recently reports indicated that ICE the parent company of the New York Stock Exchange held discussions about investing at a potential valuation of up to 5 billion dollars.

PayBox represents MoonPays latest effort to expand into AI driven financial tools. The product functions as a crypto wallet that integrates directly with popular AI assistants including Claude and ChatGPT. Users can install a PayBox plugin into their preferred AI platform create an account and automatically generate a cryptocurrency wallet. Once set up the AI can handle a wide range of transactions through natural conversation. Users simply chat with the AI to buy sell swap or bridge tokens without needing to navigate complex interfaces or manage private keys manually in most cases.

The integration aims to lower the barrier for newcomers while offering convenience for experienced users. By keeping the private key within a secure window and preventing the AI agent from accessing it directly PayBox emphasizes user control and privacy during automated operations.

A major draw during the launch has been the welcome reward program offering free USDC. Participants who created accounts connected their AI assistants and linked their X accounts received varying amounts of USDC. The reward size depended on factors such as whether the AI account was free or paid and the connection with X. Many users reported receiving tens to hundreds of dollars in USDC during the first night of availability. Account creation temporarily closed due to high demand but reopened shortly afterward allowing more people to join.

This promotion highlights how companies are using incentives to drive adoption of new products in the competitive crypto space. While the free USDC offers immediate value the longer term appeal of PayBox lies in its potential to streamline everyday crypto activity through conversational AI.

For those interested in trying PayBox the process involves visiting the official platform following the steps to connect an AI assistant such as Claude or ChatGPT creating an account and linking an X profile where required. Users should always verify they are on the legitimate site and exercise caution with any new financial tool.

As with any cryptocurrency related activity it is important to remember that digital assets carry risks including price volatility and potential security issues. This article is intended for informational purposes only and should not be considered investment advice. Individuals are encouraged to conduct their own research before participating in any promotion or using new financial products.

The introduction of PayBox shows MoonPays continued focus on innovation by combining its established payment infrastructure with emerging AI capabilities. As more users explore AI assisted crypto tools products like this could play a growing role in how people interact with digital assets in the future.

Over $1 trillion wiped from the U.S. stock market

The United States stock market experienced a sharp decline on July 29 2026 with more than one trillion dollars in market value erased according to multiple financial reports including coverage from market watchers. Major indexes closed lower after a day of significant volatility as investors reacted to the latest Federal Reserve policy decision combined with rising long term bond yields and renewed geopolitical tensions in the Middle East.

The Federal Open Market Committee concluded its July meeting by keeping the target range for the federal funds rate unchanged at 3.50 percent to 3.75 percent. This marked the fifth consecutive meeting without a rate adjustment. The decision came on a 9 to 3 vote with three members dissenting in favor of an immediate quarter point increase. Those dissenters were Beth Hammack of the Cleveland Fed Neel Kashkari of the Minneapolis Fed and Lorie Logan of the Dallas Fed. Newly installed Federal Reserve Chair Kevin Warsh emphasized that inflation remains elevated above the central banks two percent target while noting solid economic growth and strong capital investment particularly linked to artificial intelligence.

Following the announcement longer term Treasury yields moved higher. The 30 year Treasury yield climbed to approximately 5.22 percent reaching levels not seen since 2007. Market participants interpreted the combination of the rate hold the hawkish dissents and Warshs comments on inflation as signaling that borrowing costs could remain elevated for longer or that further tightening might still be needed later in the year. Higher yields typically pressure equity valuations especially for growth oriented technology companies that are sensitive to discount rates.

At the same time geopolitical developments added to investor caution. Iran launched a surprise missile attack targeting United States forces in the Middle East. President Donald Trump responded by stating that the United States would hit Iran hard. Oil prices rose in reaction raising fresh concerns about energy driven inflation pressures and potential disruptions around the Strait of Hormuz.

Equity markets reflected these developments with broad based selling. The Dow Jones Industrial Average fell by several hundred points with some reports citing declines in the range of 800 to more than 1100 points. The S and P 500 declined by more than one percent while the Nasdaq Composite posted a similar loss. Technology and semiconductor stocks led the downturn as names such as Nvidia Tesla and AMD came under pressure. Trading featured notable intraday swings before indexes settled lower at the close.

Analysts pointed to the interaction of monetary policy signals and external shocks as the primary drivers of the session. The Federal Reserves decision not to cut rates or provide a more accommodative outlook disappointed some investors who had hoped for clearer support while the presence of dissenting votes for a hike reinforced the view that inflation risks remain front and center. Elevated bond yields tightened financial conditions further weighing on risk assets. The simultaneous rise in oil prices from Middle East tensions compounded the negative sentiment.

Looking ahead market participants are closely monitoring upcoming economic data and the Federal Reserves next opportunities for communication including the Jackson Hole symposium. Attention is also focused on whether the central bank will adjust policy at its September meeting amid ongoing debates about the path of inflation and growth. The July 29 session served as a reminder of how sensitive equity markets remain to shifts in interest rate expectations and geopolitical developments.

In summary the sharp drop in United States stocks on July 29 2026 resulted from the Federal Reserves decision to hold interest rates steady the accompanying rise in long term yields concerns over persistent inflation and escalating tensions involving Iran. The episode erased substantial market capitalization and highlighted continued uncertainty surrounding the trajectory of monetary policy and global risks.

FSB formally charged Pavel Durov with “facilitating terrorism”

Russia’s Federal Security Service formally charged Telegram founder and chief executive Pavel Durov with facilitating terrorist activities on July 29 2026 and placed him on an international wanted list. The FSB announced that it had issued an international arrest warrant for Durov in connection with the criminal case under Part 1.1 of Article 205.1 of the Russian Criminal Code.

According to the FSB statement the charges stem from Telegram’s alleged failure to remove channels chats and bots that were used by Ukrainian special services as well as terrorist and extremist organizations. Russian authorities claim these tools helped prepare and coordinate acts of sabotage terrorism mass killings and cyber fraud operations inside the Russian Federation. The agency stated that such activities have caused numerous human casualties including women and children along with material damages amounting to billions.

Neither Durov nor Telegram has issued an immediate public response to the latest development. The news marks a significant escalation in the long running dispute between Moscow and the messaging platform that has more than one billion users worldwide.

The criminal investigation against Durov first became public in February 2026 when Russian state media reported that the FSB had opened a case accusing him of assisting terrorist activity. At that time outlets linked to the government claimed Telegram had been involved in more than 153000 crimes since 2022 including tens of thousands related to sabotage terrorism and extremism. Durov responded on social media by describing the case as a fabricated pretext designed to restrict Russians access to privacy and free speech. He called the situation a sad spectacle of a state afraid of its own people.

In April 2026 Durov revealed that he had received a summons sent to an old address in Russia that named him as a suspect in the ongoing case. Russia has also imposed technical restrictions on Telegram since the middle of 2025 forcing many users to rely on virtual private networks to access the service. At the same time Russian authorities have promoted the state backed MAX messenger as an alternative.

Durov was born in Russia and previously founded the social network VKontakte. He left the country in 2014 after refusing requests from the FSB to hand over user data related to Ukrainian protesters. He currently holds French and United Arab Emirates passports and resides primarily outside Russia. Telegram which he launched in 2013 remains widely used on both sides of the Russia Ukraine conflict including by Russian military personnel and opposition figures.

In parallel Durov continues to face separate legal proceedings in France. French authorities arrested him in August 2024 and have investigated allegations that Telegram failed to adequately moderate criminal content and did not sufficiently cooperate with law enforcement requests. Durov has consistently denied any wrongdoing in those matters.

The latest Russian charges highlight the tension between encrypted messaging platforms that prioritize user privacy and governments that demand greater content control and data access. Telegram has long resisted requests for backdoors or broad censorship arguing that such measures would undermine the security of hundreds of millions of users. Russian officials for their part maintain that the platform has become a tool for activities that threaten national security.

Analysts note that Telegram occupies a complicated position inside Russia. The service is used extensively by ordinary citizens government agencies and military bloggers yet it operates beyond the full reach of state regulation. The international warrant against Durov may increase pressure on the company and could affect its operations within the country. It also raises questions about how other governments will respond to similar demands for greater platform accountability.

As of July 29 2026 the situation remains fluid. The FSB has confirmed the formal charges and the international wanted status while Durov and Telegram have stayed silent on the new developments. The case continues to draw attention to the broader global debate over encryption privacy and the responsibilities of technology companies in times of geopolitical conflict.

U.S. Senate Puts Crypto Clarity Act on Hold

The US Senate has postponed consideration of the Digital Asset Market Clarity Act as lawmakers shift focus to other priorities ahead of the August recess. The decision announced on July 27 2026 by Majority Leader John Thune places the long awaited crypto market structure bill on hold while the chamber advances nominations and a Russia sanctions package.

The Clarity Act also known as H.R. 3633 aims to establish clear federal rules for digital assets by defining the respective roles of the Securities and Exchange Commission and the Commodity Futures Trading Commission. Supporters argue the legislation would end years of regulatory uncertainty that has hindered innovation and pushed activity offshore. The House of Representatives passed its version of the bill in July 2025 by a bipartisan vote of 294 to 134. The Senate Banking Committee later advanced a related version in May 2026 by a 15 to 9 margin.

On July 22 Senate Republicans released an updated draft of approximately 616 pages. The new text merges work from the Banking and Agriculture committees and introduces an ethics provision developed with input from the White House. Under the proposal covered federal officials and their spouses would be barred from issuing or sponsoring digital assets in exchange for consideration during their time in public service. The restriction would sunset in 2029 and enforcement authority would rest solely with the Attorney General.

Despite the updated language and reports that President Donald Trump accepted the ethics framework disagreements with Senate Democrats persist. Critics maintain the provisions do not go far enough on consumer protection illicit finance and conflicts of interest. These unresolved issues combined with limited floor time have complicated efforts to schedule a full Senate vote.

Majority Leader Thune indicated that nominations and the Russia sanctions bill take precedence in the current schedule. The sanctions measure is linked to the late Senator Lindsey Graham and is expected to occupy significant time this week. Thune has expressed interest in beginning work on the Clarity Act before lawmakers depart for the August state work period but has not committed to a firm timeline.

The practical deadline for action before the recess falls around early August. If the bill fails to advance in the coming days it will likely face a much narrower path when Congress returns in September. Prediction markets have reflected growing skepticism with odds of the legislation becoming law in 2026 declining in recent weeks.

Industry groups including major asset managers and crypto platforms continue to urge swift consideration arguing that regulatory clarity is essential for maintaining United States leadership in digital asset markets. Without passage the sector remains subject to a patchwork of enforcement actions rather than a comprehensive statutory framework.

The coming days will determine whether the Clarity Act can secure floor time before the summer break or whether further delays will push meaningful progress into the post recess period and closer to the midterm elections.

South Korea’s KOSPI just crashed over 8%

South Koreas benchmark KOSPI index plunged more than 8 percent on July 28 2026 falling to around 6210 points and triggering a temporary trading halt. The sharp decline marked one of the most severe single day drops in recent weeks as heavy selling hit the countrys dominant semiconductor stocks. Samsung Electronics dropped approximately 9.5 percent while SK Hynix fell about 11 percent. These two companies together account for roughly half of the KOSPI market capitalization making their movements decisive for the overall index.

The Korea Exchange activated a sell side sidecar mechanism shortly after the market opened to suspend program trading. When selling pressure continued the exchange imposed a full circuit breaker that halted trading on the main board for 20 minutes. This was the latest in a series of volatility controls used throughout 2026 as the market has swung dramatically.

The selloff occurred against a backdrop of renewed concerns about the sustainability of artificial intelligence related chip demand. Global semiconductor stocks had weakened in the previous session with investors questioning the pace of capital spending by major technology firms. Additional pressure came from developments in China including the listing of a domestic memory chip producer and reports related to local manufacturing capabilities which raised worries about future oversupply in the memory sector.

South Koreas stock market had been one of the strongest performers worldwide earlier in 2026 driven by explosive gains in Samsung and SK Hynix. Both companies benefited from strong demand for high bandwidth memory chips used in AI servers and data centers. The KOSPI reached a record high above 9100 points in June before entering a sharp correction. From that peak the index has declined more than 25 percent placing it firmly in bear market territory even while remaining significantly higher on a year to date basis.

High levels of retail investor leverage have amplified the declines. Many individual investors used margin loans and leveraged exchange traded products tied to the major chipmakers during the earlier rally. As prices fell margin calls forced additional selling which intensified the downward spiral. Foreign investors have also reduced exposure contributing to the pressure on the market.

Analysts note that the extreme concentration of the KOSPI in just two stocks has made the index particularly vulnerable to shifts in global technology sentiment. When semiconductor shares weaken the entire market tends to follow regardless of conditions in other sectors of the Korean economy. Volatility measures for the KOSPI have remained elevated throughout July reflecting the rapid swings between sharp gains and steep losses.

The latest drop comes one day before SK Hynix is scheduled to report quarterly earnings its first results since a major listing related event earlier in the period. Investors will closely watch guidance on memory demand and pricing for signs of whether the AI driven upcycle remains intact. Samsung Electronics is also expected to release results in the coming days.

Market participants are monitoring broader global developments including United States technology earnings trends and any signals about artificial intelligence infrastructure spending. The close linkage between Korean chipmakers and major American technology firms means that sentiment in one market often spills over quickly into the other.

While the long term outlook for memory chips used in artificial intelligence applications remains positive according to many industry observers the recent correction highlights the risks of rapid valuation expansion and high leverage. South Korean authorities have previously expressed concern about the stability risks created by concentrated leveraged positions in a small number of stocks.

The KOSPI performance on July 28 underscores the challenges facing investors in one of the worlds most concentrated major equity markets. As the semiconductor cycle continues to evolve the index is likely to remain highly sensitive to changes in global technology demand and risk appetite.

WEMIX Smart Contract EXPLOITED – $6.25M

On July 26 2026 the WEMIX blockchain ecosystem backed by South Korean gaming company Wemade confirmed a security incident involving its WEMIX Dollar stablecoin also known as WEMIX$. An attacker gained control of the owner privileges on the related smart contract and used that access to mint and transfer approximately 6.25 million dollars worth of tokens.

The incident did not stem from a flaw in the smart contract code itself. Instead the attacker obtained the privileged owner keys which allowed unrestricted minting of new WEMIX$ tokens. These newly created tokens were then moved out of the contract. Reports indicate that a portion of the minted tokens was later converted resulting in roughly 724000 dollars in USDC.e being bridged and swapped across other networks.

WEMIX responded quickly after detecting the abnormal activity. The team identified the addresses linked to the attack suspended bridge services native token trading and several other network functions and froze affected funds where possible. Officials stated they are collaborating with cryptocurrency exchanges blockchain security firms and law enforcement authorities to trace the movement of the assets and limit further damage.

This event marks the second notable security issue for the WEMIX ecosystem in recent years. In February 2025 the platform suffered a separate incident involving the Play Bridge Vault that resulted in the loss of more than 6 million dollars in WEMIX tokens due to compromised authentication keys. The latest case again highlights the risks associated with centralized key management in blockchain systems even when the underlying smart contract logic remains intact.

$WEMIX operates as a USDC collateralized stablecoin on the WEMIX 3.0 mainnet and had already been scheduled for a gradual transition toward broader use of USDC.e. Following the breach the project advised users to rely solely on official channels for updates while the investigation continues. Market observers note that privileged access compromises remain one of the most common and damaging attack vectors in the cryptocurrency sector during 2026.

As the team works to contain the fallout and recover or freeze stolen assets the incident serves as a reminder of the importance of robust operational security practices around admin keys and multi signature controls in blockchain projects.

BitMart has officially closed cryptocurrency trading

Cryptocurrency exchange BitMart has officially announced plans to commence an orderly wind down of its trading platform operations in a move that follows closely after the recent BitMEX shutdown decision. The announcement came on July 26 2026 and marks another significant development in the ongoing challenges facing centralized crypto exchanges during the current prolonged bear market.

According to the official statement from BitMart the decision resulted from a careful evaluation of the companys operating conditions the broader market environment and its future strategic direction. The exchange expressed deep regret over the necessary step while emphasizing its commitment to an orderly transparent and responsible process for users.

The timeline for the cessation of operations begins immediately. Starting July 26 2026 at 0130 UTC BitMart began gradually suspending new user registrations all cryptocurrency and fiat deposits and the placement of new trading orders. Futures accounts entered reduce only mode preventing the opening of new positions while spot trading stopped accepting new orders. Automated services such as copy trading grid trading and API trading are also being phased out.

All trading services including spot and futures will be fully discontinued on August 26 2026 at 0100 UTC. Any remaining open futures positions at that time may be settled by the platform according to applicable mark or index prices and settlement rules which will be detailed in separate announcements. BitMart Earn staking lending Launchpad and related products will be discontinued in phases with specific redemption and settlement procedures communicated to affected users.

The platform is scheduled to officially cease operations at 1559 UTC on January 31 2027. After this date users will retain limited access for a period to review account history and submit withdrawal requests under the procedures then in effect.

Withdrawal services will remain available throughout the wind down period. BitMart strongly encourages all users to complete any required identity verification close all trading positions and withdraw their assets as early as possible ideally before the August 26 trading discontinuation. Some withdrawal requests may undergo additional compliance and risk reviews including KYC verification source of funds checks and sanctions screening which could extend processing times especially amid high volumes.

Users are advised to log into official channels cancel outstanding orders redeem eligible earn products carefully verify withdrawal networks and addresses and securely retain records of balances and transaction history. The exchange has issued strong warnings against scams noting that it will never request fees for expedited processing account unfreezing or security deposits through unofficial channels such as Telegram or WhatsApp and will never ask for passwords private keys or recovery phrases.

This development comes just days after BitMEX announced its own plans to shut down operations effective September 23 2026. BitMart which has served millions of users across more than 180 countries and territories since its founding around 2017 to 2018 previously faced a major security breach in December 2021 involving losses estimated between 150 and 200 million dollars from hot wallets. The exchange later compensated affected users and continued operations reaching a reported user base of approximately 12 to 13 million.

The successive closures of notable exchanges highlight the intense pressures of the current crypto bear market characterized by declining volumes heightened competition from larger platforms and challenging liquidity conditions. BitMarts native token BMX experienced a sharp decline exceeding 60 percent in the wake of the announcement reflecting typical market reactions to exchange wind down news.

BitMart has stated its intention to manage the process responsibly and will continue providing updates through official website app email and support channels. Users with questions are directed to the official help center and ticket system though response times may be longer due to increased inquiry volumes.

The dual announcements from BitMEX and BitMart underscore the difficult environment for mid tier centralized exchanges in 2026 as the industry navigates prolonged market weakness. Market participants are reminded to prioritize asset security by using only verified official platforms and completing withdrawals promptly where necessary.

BitMEX is shutting down

BitMEX, one of the longest known entities in cryptocurrency trading, has revealed it will be shutting down its angular trading operations on September 23. This decision comes after the board conducted a strategic review of its parent company HDR Global Trading Limited to help focus on future growth strategies and clients, ending more than 11 years in business.

But from 26 August 2026, users will no longer be able to open new trading positions and will only be permitted to reduce or close existing ones. On September 23, 2026, at 04:00 UTC, trading stops entirely, and any open positions at this moment will be force-closed and liquidated automatically.

The platform will operate in a limited capacity with users able to log into their accounts, view balances, and withdraw funds. However, users who leave money on the platform after closure may be charged a monthly maintenance fee of either $50 or 1% of their account balance per year, whichever is higher.

If you have any funds at BitMEX, close your positions and withdraw your funds ASAP, long before the September 23 deadline. You are of course running the risk of complication if you leave it until the death, and any remaining open positions at close will be forced liquidated to market price. The last bit of good news is that user assets are safe through the winding down process, at least according to BitMEX but it's up to each user's responsibility in making sure their movements get dealt with on time. All of the BMEX token staking has been reversed and tokens returned to accounts.

BitMEX was one of the earliest players in the crypto space and launched back in 2014. It created the perpetual swap contract: a leveraged trading product that has since become one of the most popular instruments in the entire industry. The model that BitMEX pioneered is an important part of virtually every major exchange offering derivatives today.

The exchange also maintained an unusually strong security record, claiming never to have lost customer funds to a hack throughout its operating life.

Over the last few years, BitMEX fell behind bigger and faster-growing rivals. In June 2026, the platform experienced significant leadership turmoil when its CEO, CFO, and CGO all left. Peter Wilkinson, the company's former global general counsel, took on a role leading the business through its closing chapter.

In the case of September 23, trading is permanently halted afterwards but users will be able to log into their accounts and withdraw funds for a while after the closure date. The company has yet to specify how long that withdrawal window will stay open, which is just another incentive to get off your butt and act sooner rather than later.

This is the end of an era for anyone who's traded on BitMEX over the years. Yet for existing users, it is clear-cut: verify your account and take your money out ahead of time.

Verus Just Hacked SECOND TIME THIS YEAR

On July 23, 2026, around $7.53 million was lost due to the second exploit of the Verus Ethereum Bridge in merely over two months. What makes this especially frightening is that the hacker utilized the same vulnerability on which after the may hack was pledged to have been repaired.

Cross-chain bridges act as an exchange of currency. You pay in money on one hand, and you get the equivalent out on the other end. The system is supposed to verify that what goes in comes out. That check was compromised in this instance.

The attacker tricked the Ethereum side of the bridge into issuing millions of dollars worth of real assets from its reserves, without making a genuine deposit, by sending as little as 0.01 VRSC worth only pennies of Verus coin according to blockchain security firm Blockaid. Amongst the stolen proceeds are ETH, BTC, USDC, USDT, and various other tokens. The attacker then exchanged all of it for ETH and started moving it through Tornado Cash to hide the stolen crypto.

The May 2026 attack also targeted the same bridge (just under $11.4 million claimed, with actual losses drained between that and an estimated $11.58 million). The same flaw - the failure to validate values in checkCCEValues, a function in the bridge's smart contract - was behind both attacks. Security analysts highlighted that it would have taken only about ten lines of additional code to fix it.

Although the Verus team did issue a patch and a network upgrade in early July, that July's attack was successful using the same method indicates that the fix wasn't foolproof. The initial attacker even returned nearly 75% of the funds taken, after entering into a bounty agreement following the first hack. Well, that goodwill was not repeated this time round.

The timing makes this worse. A similar exploit of another bridge also took place on that same morning. Notably, AFX Trade lost about 24.15 million in USDT via its operations bridge on Arbitrum, while B2 Network was targeted in a separate incident that cost the casino $3.86 million. In a single morning, more than $35 million was emptied from bridge protocols.

The recommendation of a security researcher is simple: if you have assets on the other end of that Verus Ethereum Bridge, get those funds off if possible and do not use the bridge until the dev team creates a verified fix. At the time of this writing, no formal public statement had been made.

Bridges tend to be the most targeted infrastructure in all of crypto due to large amounts of assets being held in reserve and inherently complexity. An unguarded code line can be attacked and exploited for millions of dollars in a matter of minutes.

This situation with Verus in part demonstrates the point that patching a vulnerability is insufficient. However, the potential repercussions of a second failed patch go beyond just losing money, so any fix must be audited and tested thoroughly before reopening a bridge. Getting hacked twice by the same vulnerability within weeks of a claimed fix is the sort of thing that permanently erodes trust in a project. As for devs trying to build bridges, the moral of this story is simple: never open a bridge until you can be sure beyond a shadow of a doubt that the problem has been eliminated and not just papered over.