Ethereum

Arbitrum

Stake DAO

USDC

Security

<p class="is-style-lead">AFX suffered a $24.15 million USDC loss after an attacker targeted a cross-chain bridge linked to the trading protocol on July 22.</p><div id="cn-block-summary-block_034b64058d5fdb18de93a7e770c2bec0" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>AFX’s cross-chain bridge lost $24.15 million USDC while Arbitrum’s native bridge remained unaffected during attack.</li><li>The exploiter moved stolen USDC to Ethereum and converted the proceeds into 12,467.5 ETH afterward.</li><li>Security firms are tracing the stolen funds as AFX and Arbitrum teams investigate the breach.</li></ul></div></div><p>The incident triggered an investigation by Blockaid and the Arbitrum team, while on-chain trackers followed the stolen funds to Ethereum.</p><p>The attack did not affect Arbitrum’s native bridge. AFX operates its own sovereign Layer 1 for perpetual trading but accepts USDC deposits through Arbitrum. The affected infrastructure was a third-party bridge operated by AFX rather than Arbitrum’s core bridge.</p><p>You might also like: <a href="https://crypto.news/japans-first-bitcoin-etf-could-arrive-by-2028/" rel="noopener noreferrer nofollow"> Japan’s first Bitcoin ETF could arrive by 2028 with ¥3T inflows </a></p><h2 class="wp-block-heading" id="strong-afx-bridge-loses-24-15-million-usdc-strong"><strong>AFX bridge loses $24.15 million USDC</strong></h2><p>Blockaid said it <a href="https://x.com/blockaid_/status/2080080240265621680?s=20" rel="noopener noreferrer nofollow">detected</a> the exploit at 9:30 p.m. UTC on July 22. The firm said the attack targeted a bridge operated by AFX and drained about 24.15 million USDC. An Arbiscan record shows a successful transfer of 24,150,000 USDC from the bridge contract to the recipient address at 9:30:25 p.m. UTC.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p>Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting <a href="https://x.com/AFX_XYZ?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@AFX_XYZ</a>, a protocol on <a href="https://x.com/arbitrum?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@arbitrum</a>. The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol.<br><br>Our team has been working with the incredible folks on… <a href="https://t.co/0Qd9ve5gPB" rel="noopener noreferrer nofollow">https://t.co/0Qd9ve5gPB</a></p>— Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2080080240265621680?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 22, 2026</a></blockquote></div></figure><p>The security firm said it was working with the Arbitrum team to respond, contact the affected protocol and help contain the stolen funds. Based on the public updates reviewed at publication time, no recovery had been confirmed.&nbsp;</p><p>AFX had also not published a verified technical postmortem explaining how the attacker gained authorization to withdraw the funds. The protocol had not announced a recovery plan.</p><p>Offchain Labs co-founder Steven Goldfeder confirmed that the suspicious transaction came from a third-party protocol. He also separated the AFX incident from Arbitrum’s own bridge infrastructure.</p><blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"><p>“We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said.&nbsp;</p></blockquote><p>He added that the team would coordinate with the third-party protocol and share more details when available.</p><p>AFX uses Arbitrum as a route for USDC deposits while running its trading system on a dedicated Layer 1. AFX describes itself as a decentralized derivatives platform built around a sovereign execution environment. A recent protocol post also said users could deposit USDC from Arbitrum before accessing its perpetual markets.</p><h2 class="wp-block-heading" id="strong-exploiter-converts-stolen-usdc-into-eth-strong"><strong>Exploiter converts stolen USDC into ETH</strong></h2><p>PeckShield said the attacker moved the stolen USDC from Arbitrum to Ethereum and converted the proceeds into 12,467.5 ETH. Lookonchain separately <a href="https://x.com/lookonchain/status/2080092059252486487?s=20" rel="noopener noreferrer nofollow">reported</a> that the exploiter bought about 12,467 ETH at an average price near $1,937 per ETH after moving the funds.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p><a href="https://x.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a><a href="https://x.com/AFX_XYZ?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@AFX_XYZ</a> on <a href="https://x.com/hashtag/Arbitrum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Arbitrum</a> has been exploited for ~$24M USDC. The exploiter has bridged the stolen funds from <a href="https://x.com/hashtag/Abitrum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Abitrum</a> to <a href="https://x.com/hashtag/Ethereum?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#Ethereum</a> and swapped them for 12,467.5 <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a>, currently sitting in 0x6276…ebAC.<a href="https://t.co/INZ7ZxtRhE" rel="noopener noreferrer nofollow">https://t.co/INZ7ZxtRhE</a><a href="https://t.co/fUHFfEn1F5" rel="noopener noreferrer nofollow">pic.twitter.com/fUHFfEn1F5</a></p>— PeckShield <a href="https://x.com/PeckShieldAlert/status/2080088731558801909?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 23, 2026</a></blockquote></div></figure><p>The conversion moved the stolen value from a U.S. dollar-pegged stablecoin into Ether, exposing the holdings to ETH price movements. Security teams continued tracing the funds after the swap. At publication time, the reviewed sources did not confirm that Circle had frozen the USDC before conversion or that any of the ETH had been recovered.</p><p>The attack adds to several bridge-related security incidents this year. As crypto.news previously <a href="https://crypto.news/stake-dao-exploit-update-key-products-unaffected-bridge-closed/" rel="noopener noreferrer nofollow">reported</a>, Stake DAO closed its vsdCRV bridge after an unauthorized mint on Arbitrum in May. The project said it secured the token’s mainnet backing and contained the incident to the affected bridge.</p><p>Earlier in April, a larger exploit hit <a href="https://crypto.news/kelpdao-290m-hack-wipes-13b-from-defi/" rel="noopener noreferrer nofollow">Kelp DAO’s</a> LayerZero-powered bridge. Attackers drained roughly 116,500 rsETH worth about $292 million. <a href="https://crypto.news/arbitrum-locks-71m-in-eth-linked-to-kelp-dao-exploit/" rel="noopener noreferrer nofollow">Arbitrum later froze more than 30,000 ETH</a> linked to that attacker after the funds moved onto Arbitrum One.</p><h2 class="wp-block-heading" id="strong-investigation-focuses-on-afx-operated-infrastructure-strong"><strong>Investigation focuses on AFX-operated infrastructure</strong></h2><p>The investigation now centers on the AFX-operated bridge and the authorization process behind the 24.15 million USDC withdrawal. The confirmed transaction shows that the bridge contract finalized the transfer, but public statements do not yet establish the verified root cause. A full postmortem may determine whether the incident involved compromised validator credentials, faulty access controls or another weakness.</p><p>The main confirmed point is that the exploit affected infrastructure operated by AFX rather than Arbitrum’s native bridge. Blockaid and Offchain Labs both made that separation clear in their initial responses. The Arbitrum network continued operating, and reviewed reports showed no loss from its native bridge.</p><p>The incident also places attention on AFX’s deposit infrastructure. The protocol has promoted USDC deposits from Arbitrum as an entry route into its trading platform. Any changes to deposits, withdrawals or bridge operations will depend on the protocol’s response and the ongoing investigation.</p><p>The case remains developing. The confirmed loss stands at about $24.15 million in USDC, while on-chain trackers have traced the stolen value into roughly 12,467 ETH on Ethereum. Further updates are expected from AFX, Blockaid and the Arbitrum team as they review the breach and track the attacker’s funds.</p><p>Read more: <a href="https://crypto.news/s-p-and-pantera-bitcoin-revenue-based-crypto-index/" rel="noopener noreferrer nofollow"> S&amp;P and Pantera exclude Bitcoin from new revenue-based crypto index </a></p>

AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH

Table of Contents

crypto.news

Other articles published on Jul 23, 2026

AFX Trade on Arbitrum Exploited for $24.15 Million in USDC

How Does Pump.Fun Make Money?

A Closer Look at Avalanche's 2026 Fundamentals

Elon Musk And Dogecoin: How One Man Shaped A Memecoin’s Price And Reputation

Report: Cardano's Biggest Updates from H1 2026

Crypto's Top Five Centralized Exchanges

Join our free newsletter for daily crypto updates!