AFX Trade bridge exploit: $24M USDC stolen, swapped for ETH

AFX Trade lost $24.15M in USDC after a bridge exploit on Arbitrum. The attacker used validator signatures, moved funds to Ethereum, and swapped them for 12,467 ETH.

AFX Trade, a decentralized derivatives platform, experienced a significant exploit on July 22, resulting in the loss of approximately $24.15 million in USDC. The attack targeted a cross-chain bridge operated by AFX on the Arbitrum network. Security firm Blockaid detected the unauthorized withdrawal around 21:30 UTC, noting that signatures from five hot validators—representing over two-thirds of the bridge's validator power—authorized the transfer. The transaction passed through a brief dispute window before the funds were released. The stolen USDC was then bridged to Ethereum and swapped for about 12,467 ETH at an average price of $1,937 per ETH. Offchain Labs confirmed that Arbitrum's native bridge infrastructure was not affected by the incident. At the time of reporting, AFX had not released a technical postmortem or official statement. The exploit has heightened concerns about the security of cross-chain bridges and validator authorization processes within DeFi protocols.