# Bridge and Validator Compromises Took Roughly $32 Million as Coldcard Seed Losses Kept Growing

Five compromised validator signatures cleared a two-thirds threshold to drain $24.15 million from AFX Trade on Arbitrum, and VerusCoin's Ethereum bridge lost $7.54 million in its second breach this year.

- Published: 2026-08-16T05:37:57.333Z
- Canonical: https://polylog.news/crypto/2026-08-16/bridge-and-validator-compromises-took-roughly-32-million-as
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News](https://www.rekt.news/), [Rekt News (Cold Card)](https://www.rekt.news/), [CoinDesk](https://www.coindesk.com/business/2026/08/15/clarity-survives-barely-strategy-sells-and-the-untold-story-of-mastercard-s-usd1-8-billion-deal-crypto-s-week-in-5-stories)

Three incidents documented by [Rekt News](https://www.rekt.news/) share a root cause that no contract audit would have flagged, because in each case the code did what it was written to do.

The largest was AFX Trade. Attackers obtained five validator signatures, enough to clear the two-thirds threshold guarding the platform's dollar-token custody bridge on Arbitrum, and moved $24.15 million out of the contract through ordinary public transfers. The bridge validated the withdrawal correctly. What failed was the trust placed in that set of signers, not the verification logic itself.

VerusCoin lost $7.54 million from its Ethereum bridge, the second breach of the same bridge after an $11.6 million loss in May. Rekt describes it as a different gap inside the same trust boundary, which is the pattern that makes bridges the most repeatedly drained component in the industry. Separately, the payments processor Coinsbuy lost roughly $8.07 million across Tron and Ethereum in under an hour on 9 August, with wallets on both chains emptied almost simultaneously, a pattern consistent with compromised signing infrastructure rather than a contract flaw. The drained wallets were refilled within half a day, which suggests the operator absorbed the loss rather than passing it to users, though Coinsbuy has not published a full account.

The hardware-wallet failure that CoinDesk described [in a report on wallet-security concerns that drove large bitcoin transfers between wallets](https://www.coindesk.com/business/2026/08/15/clarity-survives-barely-strategy-sells-and-the-untold-story-of-mastercard-s-usd1-8-billion-deal-crypto-s-week-in-5-stories) remains the costliest of the group. A Coldcard firmware build shipped in March 2021 carried a setting that skipped the device's dedicated hardware randomness chip and fell back to a software generator seeded from the chip serial number and clock registers, cutting effective key entropy on the Mk3 model from 128 bits to roughly 40. That is guessable offline. A coordinated sweep on 30 July removed more than 1,082 bitcoin from about 1,196 wallets in roughly 41 minutes, and published estimates of total losses run from about $116 million across more than 5,200 addresses to as high as $130 million if a fourth wave is confirmed. Multiple independent attackers exploited the same defect, and none of them needed physical access to a device.

## What this means

Every one of these losses passed through a component users were told to trust absolutely: a validator quorum, a bridge trust boundary, a certified hardware random-number generator. The exposed parties are self-custody holders, who now face the uncomfortable finding that a sealed device can fail silently for five years, and bridge users, who carry counterparty risk to a signature set they cannot inspect. The commercial consequence flows to custodians and exchange-traded products, which gain customers each time a self-custody failure is priced in dollars rather than in theory, and to bridge operators, who now have to justify the makeup of their validator sets the way a bank justifies its counterparties.

## What to watch

- Whether Coldcard losses stop at the currently confirmed addresses or a fourth attack wave is verified, which would settle whether the exposed key population has been fully swept.
- Whether AFX Trade or its validators identify how the five signing keys were obtained, since a supply-chain or operator compromise would mean other bridges with the same operator overlap are exposed too.
- Whether Coinsbuy publishes a post-incident report, the test of whether a payments processor that quietly refills drained wallets is solvent or simply deferring the disclosure.