AFX Trade lost 24.15 million USDC in a bridge exploit on Arbitrum after attackers compromised validator signatures. Here's what happened and whether user funds are safe.
A hacker stole around $24.15 million in USDC after exploiting AFX's custody bridge. In the aftermath of the incident, AFX offered the hacker a multimillion-dollar deal (bounty) to return the stolen funds.
Following the attack, rumors spread that Arbitrum had been hacked, but the network quickly denied any security breach.
Blockchain security firm Blockaid detected the exploit on July 22, identifying an unauthorized withdrawal from AFX's USDC custody bridge on Arbitrum.
The bridge, which is independently operated by AFX, lost approximately 24.15 million USDC in a single exploit.
Initial reports led some users to believe Arbitrum itself had been compromised. But Offchain Labs co-founder Steven Goldfeder quickly said the network was working fine and that there was no issue with Arbitrum itself.
"We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way."
His statement confirmed that the breach was isolated to AFX's infrastructure rather than Arbitrum's official bridge or network.
According to Blockaid's on-chain analysis, the attacker compromised the bridge's hot validator signing path. The bridge requires validator approvals before releasing funds, and withdrawals become valid only after enough validator voting power signs the transaction.
The attacker successfully obtained five hot validator signatures, representing 7,142 of the bridge's 10,000 validator voting power, well above the required two-thirds quorum.
Because the signatures appeared legitimate, the bridge contract processed the withdrawal exactly as designed and released the funds after its 200-second dispute window expired.
The attacker wasted little time moving the assets. After receiving the stolen USDC from Arbitrum, the exploiter bridged the funds to Ethereum, where blockchain security firm PeckShield tracked the assets being swapped into approximately 12,467 ETH worth around $24.15 million. The ETH remains in a single wallet that investigators continue to monitor.
Unlike many previous exploits, the funds have not yet been routed through privacy mixers such as Tornado Cash.
Although the USDC has already been converted into ETH, the recovery window has not completely closed.
Because the original USDC no longer exists in its initial form, Circle cannot simply freeze the stolen assets unless the tokens remain as USDC under its control. Once swapped into ETH, recovery depends largely on blockchain tracing, exchange cooperation, and negotiations with the attacker.
AFX has already begun working with security firms including SlowMist and Zellic to track the wallet and investigate the exploit.
The protocol has also taken an unusual step by offering the attacker a 30% white-hat bounty, allowing them to keep roughly $7.25 million if they voluntarily return the remaining 70% of the stolen assets.
"Our priority is the recovery of user assets and a swift resolution for the community. We encourage you to act in good faith."
The hack happened just one day after another security incident in the Arbitrum ecosystem. On July 21, Ostium suspended trading after losing $18.4 million in an attack linked to a compromised off-chain oracle key.
While Arbitrum's main network was not affected in either case, both incidents show that third-party bridges and external systems remain some of the biggest security risks in DeFi.
Meanwhile, Arbitrum's native token, ARB, saw a slight drop and was trading at around $0.088 at press time.
No comments yet
Be the first to share your take when accounts launch.
