Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised

Tech Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised Security firms said the attacker used enough hot-validator signatures to approve a 24.15 million USDC withdrawal, while Arbitrum said its native bridge was not affected. By Shaurya Malwa Jul 23, 2026, 5:01 a.m. 2 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised. (Kevin Ku/Unsplash) Summary Show AFX Trade, a decentralized perpetuals exchange on Arbitrum that settles in USDC, was drained of about $24.15 million after an attacker compromised validator signing keys for a bridge the protocol operates. Arbitrum’s native bridge was not breached, and security firm Blockaid said the on-chain logic functioned as designed, with five hot-validator signatures meeting the quorum needed to authorize the withdrawal. The attacker moved the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH, nearly emptying AFX’s total value locked amid a broader wave of high-profile crypto hacks on Arbitrum-based protocols. AFX Trade, a decentralized perpetuals exchange that settles in dollar-pegged stablecoin USDC, was drained of about $24.15 million on Wednesday after an attacker compromised the validator signing keys behind a bridge the protocol operates on Arbitrum, blockchain data shows. Steven Goldfeder, co-founder of Offchain Labs, which develops and maintains the network, said the Arbitrum native bridge "has not been hacked or exploited in any way" and that the transaction originated from a third-party protocol. A hack of Arbitrum's own bridge would signal risk across the entire layer-2 network, but a compromised protocol running on top of it is a contained failure. Nothing in the bridge's own code logic was broken. Bridges are a blockchain-based tool to transfer tokens between various networks, including ones they were not initially supported on. Security firm Blockaid said the on-chain logic was not bypassed. Instead, five of the bridge's hot-validator signatures, the approvals that authorize a withdrawal, signed off on moving 24,150,000 USDC to the attacker's wallet, clearing the roughly two-thirds quorum the bridge requires. Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting @AFX_XYZ , a protocol on @arbitrum . The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol. Our team has been working with the incredible folks on… https://t.co/0Qd9ve5gPB — Blockaid (@blockaid_) July 22, 2026 The contract treated the withdrawal as valid and released the funds after a 200-second dispute period. The bridge did exactly what it was designed to do, but the keys authorizing were apparently in the wrong hands. The attacker then bridged the stolen USDC to Ethereum and swapped it for about 12,467 ETH, worth roughly $24 million, which on-chain trackers say now sits in a single wallet. AFX's trading activity had been climbing sharply in the run-up to the attack, with daily perpetuals volume spiking to multi-month highs in mid-July, according to DefiLlama , as the protocol drew in users and, with them, deposits. The roughly $24 million drained was almost the entirety of the protocol's total value locked, meaning the attacker emptied the vault at close to the moment it was fullest. The loss lands amid a punishing stretch for crypto security, with Q2 among the worst quarters for hacks on record and a run of Arbitrum-based protocols, including the oracle exploit that drained a separate $18 million from RWA platform Ostium a week earlier, hit in quick succession. As such, the incident is a similar failure to the roughly $285 million Drift Protocol loss in April, where attackers spent months working their way to privileged access rather than breaking any contract. Latest Crypto News 1 XRP whales accumulate as small holders capitulate 50 minutes ago 2 Bitcoin wilts as oil and rates rise. Clarity Act odds tumble to 38% 1 hour ago 3 Senator Lummis: Ethics, other provisions in crypto Clarity Act to be further discussed 5 hours ago 4 Key Democratic lawmakers say crypto Clarity Act 'falls short' on ethics, other issues 6 hours ago 5 Tesla holds bitcoin treasury steady, reports $112M impairment loss 8 hours ago 6 New draft of Clarity Act is out, and it would impose limits on Trump's crypto empire 12 hours ago 7 Revolut hits $115 billion valuation in employee share sale: WSJ 13 hours ago 8 SEC's Peirce warns some DeFi vaults, onchain lending may fall under securities laws 13 hours ago 9 UK digital bond plans hinge on one missing piece: onchain cash 13 hours ago 10 Crypto Long & Short: The crypto question isn't what to own — it's what you can survive holding 13 hours ago Latest Research Crypto Flows, Share and the Selective Rotation Crypto Flows, Share and the Selective Rotation Markets repositioned since June, but Binance held share (~55% user funds, ~24% spot) and drew net inflows in early July while the tracked market saw outflows. By CoinDesk Research 14 hours ago Markets repositioned since June, but Binance held share (~55% user funds, ~24% spot) and drew net inflows in early July while the tracked market saw outflows. Why it matters : Markets repositioned since June, but Binance held share (~55% user funds, ~24% spot) and drew net inflows in early July while the tracked market saw outflows. View Full Report More From Tech Balance stablecoin collapses 99% after $1 million exploit drains its bitcoin vaults Live updates: Bitcoin holds near $66,000 as stocks claw back from big early decline Claude's Fable 5 just solved an 87-year-old math problem, and it matters for bitcoin