AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH

AFX suffered a $24.15 million USDC loss after an attacker targeted a cross-chain bridge linked to the trading protocol on July 22. Summary AFX’s cross-chain bridge lost $24.15 million USDC while Arbitrum’s native bridge remained unaffected during attack. The exploiter moved stolen USDC to Ethereum and converted the proceeds into 12,467.5 ETH afterward. Security firms are tracing the stolen funds as AFX and Arbitrum teams investigate the breach. The incident triggered an investigation by Blockaid and the Arbitrum team, while on-chain trackers followed the stolen funds to Ethereum. The attack did not affect Arbitrum’s native bridge. AFX operates its own sovereign Layer 1 for perpetual trading but accepts USDC deposits through Arbitrum. The affected infrastructure was a third-party bridge operated by AFX rather than Arbitrum’s core bridge. You might also like: Japan’s first Bitcoin ETF could arrive by 2028 with ¥3T inflows AFX bridge loses $24.15 million USDC Blockaid said it detected the exploit at 9:30 p.m. UTC on July 22. The firm said the attack targeted a bridge operated by AFX and drained about 24.15 million USDC. An Arbiscan record shows a successful transfer of 24,150,000 USDC from the bridge contract to the recipient address at 9:30:25 p.m. UTC. Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting @AFX_XYZ, a protocol on @arbitrum. The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol. Our team has been working with the incredible folks on… https://t.co/0Qd9ve5gPB — Blockaid (@blockaid_) July 22, 2026 The security firm said it was working with the Arbitrum team to respond, contact the affected protocol and help contain the stolen funds. Based on the public updates reviewed at publication time, no recovery had been confirmed. AFX had also not published a verified technical postmortem explaining how the attacker gained authorization to withdraw the funds. The protocol had not announced a recovery plan. Offchain Labs co-founder Steven Goldfeder confirmed that the suspicious transaction came from a third-party protocol. He also separated the AFX incident from Arbitrum’s own bridge infrastructure. “We’re aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said. He added that the team would coordinate with the third-party protocol and share more details when available. AFX uses Arbitrum as a route for USDC deposits while running its trading system on a dedicated Layer 1. AFX describes itself as a decentralized derivatives platform built around a sovereign execution environment. A recent protocol post also said users could deposit USDC from Arbitrum before accessing its perpetual markets.