Attacker Steals $24M in USDC From AFX Bridge on Arbitrum

AFX Trade, a USDC-settled derivatives exchange, was exploited for about $24.15 million on July 22 after an attacker targeted a bridge the protocol operates on Arbitrum, according to security firm Blockaid. Blockaid said it identified the exploit at 21:30 UTC and shared the transaction on Arbiscan. "The exploit was specific to a bridge that AFX operates," the firm wrote, adding it is working with the Arbitrum team to respond, coordinate with the affected protocol, and help contain the stolen funds. Onchain analytics account Lookonchain said the attacker bridged the funds to Ethereum and swapped them for 12,467 ETH at an average price of $1,937, linking to the exploiter's address on Arkham. AFX had not posted a statement on its X account as of publication. The Defiant said it reached out to AFX for comment. Arbitrum: Native Bridge Not Impacted Steven Goldfeder, cofounder of Offchain Labs, said Arbitrum's core infrastructure was not affected. "We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way," he wrote, adding that more details will be shared as they become available. Bridge Nearly Emptied DefiLlama data show the AFX bridge contract on Arbitrum held roughly $24.2 million in USDC before the incident, indicating the attacker drained nearly all funds locked in the contract. Deposits had increased from about $19.3 million in mid-June. AFX, short for AntiFragile Exchange, bills itself as a sovereign Layer 1 blockchain focused on decentralized derivatives. Its website says it offers USDC-margined perpetuals with up to 100x leverage across crypto assets, equities, ETFs, and commodities. User deposits enter via the Arbitrum-based bridge contract that was exploited. The incident adds to a series of Arbitrum-related attacks in July. On July 15, perpetuals exchange Ostium halted trading after an attacker manipulated its oracle system and siphoned up to $18 million in USDC from its liquidity vault. Market reaction was muted. ETH traded near $1,928, little changed over 24 hours, while ARB slipped 0.3% to $0.0806, according to CoinGecko. ARB hit an all-time low of $0.0705 on June 26.