AFX Bridge Exploit Drains $24.15M USDC on Arbitrum; Funds Swapped Into ~12,467.5 ETH

An attacker exploited a bridge operated by AFX, an Arbitrum-based protocol, siphoning about $24.15 million in USDC in an incident detected on July 22 at 21:30 UTC, according to blockchain security firm Blockaid. The breach is the 14th crypto security incident recorded in July, a month that has already exceeded June's total hack losses. Investigators emphasized the exploit did not impact Arbitrum's native infrastructure. Offchain Labs cofounder Steven Goldfeder said the transaction originated from a third-party protocol and confirmed the Arbitrum native bridge "has not been hacked or exploited in any way." After the drain, the attacker bridged the stolen USDC from Arbitrum to Ethereum and converted it into approximately 12,467.5 ETH, PeckShield reported. PeckShield traced the assets to a single wallet address, noting the total may shift as researchers continue monitoring on-chain movements. The incident underscores persistent risks around cross-chain bridges, which remain among DeFi's most frequently exploited components due to their reliance on smart contracts, validator setups, and liquidity mechanisms. DeFiLlama data showed 13 hacks had already been logged in July before the AFX exploit, with losses totaling about $72.6 million even prior to this breach. As interoperability expands across blockchain ecosystems, bridge security remains a central hurdle for protocols seeking broader user and institutional adoption.