AFX Trade, a decentralized perpetuals exchange built on Arbitrum, got cleaned out to the tune of $24.15 million on July 22. The attacker compromised validator signing keys for the platform’s bridge, drained USDC from the protocol, bridged it all to Ethereum, and promptly swapped it for approximately 12,467 ETH at an average price of around $1,937 per token.
The platform’s response? A public offer to let the hacker keep 30% of the stolen funds, roughly $7.2 million, if they return the remaining 70%.
What happened and how the exploit worked
The attack targeted a third-party bridge operated by AFX Trade, not Arbitrum’s native bridge infrastructure. Arbitrum itself wasn’t breached, and its core bridging mechanism remains intact. The vulnerability lived in the layer AFX maintained on top of it.
The attacker gained access to validator signing keys for the AFX-operated bridge, which meant they could move funds out without restriction. The $24.15 million in USDC was bridged from Arbitrum to Ethereum and converted into ETH.
