Bridge Out, Funds Out: AFX Loses $24.15M While Arbitrum's Native Bridge Brunches Unbothered 🧇

A bridge operated by AFX, a decentralized perpetual exchange on Arbitrum, was exploited for $24.15 million on Wednesday, with the attacker converting the proceeds into 12,467 ETH within minutes. Security firm Blockaid detected the exploit at 9:30 pm UTC, identifying it as a breach targeting the AFX-operated bridge rather than Arbitrum's native infrastructure.

On-chain data shows the attacker triggered a withdrawal of exactly 24,150,000 USDC from the bridge contract at 21:30:25 UTC. Preliminary analysis suggests the attacker may have compromised validator hot keys, satisfying the 5-of-7 signature quorum required to authorize the transfer. After the drain, the stolen USDC was bridged to Ethereum through Circle's Cross-Chain Transfer Protocol and swapped for 12,467 ETH at an average price of roughly $1,937 per coin.

Stephen Goldfeder, co-founder of Offchain Labs, confirmed the incident was limited to a third-party protocol. "We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way," Goldfeder said in a post on X.

AFX Trade subsequently suspended operations and extended a 30% white-hat bounty to the exploiter in exchange for the return of the remaining funds. Lookonchain reported the fund movements, noting that the 24.15 million USDC was bridged to Ethereum before being converted into ether at the stated average price.

The exploit marks one of the largest bridge-related incidents of the year and adds to a growing list of cross-chain protocols that have suffered significant losses in 2026. Investigations remain ongoing, and additional details are expected as on-chain analysts and the AFX team continue to trace the attacker's wallet activity.