AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH

AFX suffered a $24.15 million USDC loss after an attacker targeted a cross-chain bridge linked to the trading protocol on July 22.

The incident triggered an investigation by Blockaid and the Arbitrum team, while on-chain trackers followed the stolen funds to Ethereum.

The attack did not affect Arbitrum’s native bridge. AFX operates its own sovereign Layer 1 for perpetual trading but accepts USDC deposits through Arbitrum. The affected infrastructure was a third-party bridge operated by AFX rather than Arbitrum’s core bridge.

AFX bridge loses $24.15 million USDC

Blockaid said it detected the exploit at 9:30 p.m. UTC on July 22. The firm said the attack targeted a bridge operated by AFX and drained about 24.15 million USDC. An Arbiscan record shows a successful transfer of 24,150,000 USDC from the bridge contract to the recipient address at 9:30:25 p.m. UTC.

The security firm said it was working with the Arbitrum team to respond, contact the affected protocol and help contain the stolen funds. Based on the public updates reviewed at publication time, no recovery had been confirmed. 

AFX had also not published a verified technical postmortem explaining how the attacker gained authorization to withdraw the funds. The protocol had not announced a recovery plan.

Offchain Labs co-founder Steven Goldfeder confirmed that the suspicious transaction came from a third-party protocol. He also separated the AFX incident from Arbitrum’s own bridge infrastructure.

“We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said. 

He added that the team would coordinate with the third-party protocol and share more details when available.

AFX uses Arbitrum as a route for USDC deposits while running its trading system on a dedicated Layer 1. AFX describes itself as a decentralized derivatives platform built around a sovereign execution environment. A recent protocol post also said users could deposit USDC from Arbitrum before accessing its perpetual markets.

Exploiter converts stolen USDC into ETH

PeckShield said the attacker moved the stolen USDC from Arbitrum to Ethereum and converted the proceeds into 12,467.5 ETH. Lookonchain separately reported that the exploiter bought about 12,467 ETH at an average price near $1,937 per ETH after moving the funds.

The conversion moved the stolen value from a U.S. dollar-pegged stablecoin into Ether, exposing the holdings to ETH price movements. Security teams continued tracing the funds after the swap. At publication time, the reviewed sources did not confirm that Circle had frozen the USDC before conversion or that any of the ETH had been recovered.

The attack adds to several bridge-related security incidents this year. As crypto.news previously reported, Stake DAO closed its vsdCRV bridge after an unauthorized mint on Arbitrum in May. The project said it secured the token’s mainnet backing and contained the incident to the affected bridge.

Earlier in April, a larger exploit hit Kelp DAO’s LayerZero-powered bridge. Attackers drained roughly 116,500 rsETH worth about $292 million. Arbitrum later froze more than 30,000 ETH linked to that attacker after the funds moved onto Arbitrum One.

Investigation focuses on AFX-operated infrastructure

The investigation now centers on the AFX-operated bridge and the authorization process behind the 24.15 million USDC withdrawal. The confirmed transaction shows that the bridge contract finalized the transfer, but public statements do not yet establish the verified root cause. A full postmortem may determine whether the incident involved compromised validator credentials, faulty access controls or another weakness.

The main confirmed point is that the exploit affected infrastructure operated by AFX rather than Arbitrum’s native bridge. Blockaid and Offchain Labs both made that separation clear in their initial responses. The Arbitrum network continued operating, and reviewed reports showed no loss from its native bridge.

The incident also places attention on AFX’s deposit infrastructure. The protocol has promoted USDC deposits from Arbitrum as an entry route into its trading platform. Any changes to deposits, withdrawals or bridge operations will depend on the protocol’s response and the ongoing investigation.

The case remains developing. The confirmed loss stands at about $24.15 million in USDC, while on-chain trackers have traced the stolen value into roughly 12,467 ETH on Ethereum. Further updates are expected from AFX, Blockaid and the Arbitrum team as they review the breach and track the attacker’s funds.