Third-Party Pains: AFX Bridge Loses $24.15M While Arbitrum's Own Bridge Stays Unbruised 🛡️

AFX Trade, a decentralized perpetuals exchange operating on Arbitrum, lost $24.15 million on Wednesday in an exploit targeting a crosschain bridge the protocol operates, according to security firm Blockaid. Blockaid said it detected the exploit at 9:30 pm UTC, confirming the attack was specific to an AFX-operated bridge and did not impact Arbitrum's native bridge. On-chain data shows the attacker triggered a withdrawal of exactly 24,150,000 USDC from the bridge contract. Preliminary analysis suggests the attacker may have compromised validator hot keys, meeting the 5-of-7 signature quorum required to authorize the withdrawal.

After the drain, the attacker bridged the stolen USDC to Ethereum via Circle's CCTP and swapped it for 12,467 ETH at an average price of roughly $1,937 per ETH. PeckShield reported the funds are now sitting in a single wallet. "We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way," said Offchain Labs co-founder Steven Goldfeder in a post on X.

AFX said in a statement that it immediately suspended bridge operations and initiated its incident response procedures, with engineering and security teams investigating the root cause. The protocol said the damage looked "isolated to the AFX-operated custody bridge," noting that neither its trading infrastructure and mainnet, nor the Arbitrum network itself, had been compromised. The firm added that it was working with ecosystem partners and security firms to trace the stolen assets. Hours later, AFX's head of growth, Ken C, offered the attacker a way out: return 70% of the haul and keep the other 30% as a "white hat bounty."

The incident extends a difficult year for DeFi, which has lost more than $840 million to hacks in 2026, according to industry data. It comes close on the heels of another Arbitrum perpetuals venue, Ostium, which was drained of roughly $18 million on Wednesday after attackers compromised an oracle signer key and manipulated the decentralized perpetuals exchange's price feed to generate fake trading profits, blockchain security firm Blockaid said.