AFX Trade, a decentralized exchange running on Arbitrum, just lost $24.15 million in USDC through a bridge attack. And now it’s essentially negotiating with the person who robbed it, offering them roughly $7.2 million to give the rest back.
The white-hat bounty deal, proposed publicly by AFX head of growth Ken C, would let the attacker keep 30% of the stolen funds as a “bounty” in exchange for returning the remaining 70%.
What actually happened
The exploit hit on July 22, 2026, targeting AFX Trade’s custody bridge rather than its smart contracts or Arbitrum’s underlying infrastructure. The attacker compromised off-chain validator signing keys.
Once inside, the attacker drained approximately $24.15 million in USDC from the bridge. They then moved the funds to Ethereum and swapped them for about 12,467 ETH, which was trading at roughly $1,937 per token at the time. AFX suspended its bridge immediately after discovering the breach.
