Cross-chain attacks drain $35 million within hours