An attacker compromised the private keys of five of the seven validators of the bridge AFX Trade operates on Arbitrum (7,142 of 10,000 voting units, above the 6,667 two-thirds quorum) and produced a valid withdrawal of 24,150,000 USDC, nearly the protocol's entire TVL. AFX offered a 30% bounty.
On July 22, 2026, an attacker compromised the private keys of five of the seven validators of the bridge AFX Trade operates on Arbitrum, controlling 7,142 of 10,000 voting units — above the 6,667 two-thirds quorum — and produced a valid withdrawal of 24,150,000 USDC. The contract verified the signatures and released funds after a 200-second dispute window. Blockaid detected the exploit at 21:30 UTC on July 22. The USDC was bridged to Ethereum and swapped for ~12,467 ETH held in a single wallet. Arbitrum's native bridge was not affected. The drain was nearly the protocol's entire TVL. AFX offered a 30% bounty.
The 24,150,000 USDC was bridged to Ethereum and swapped for ~12,467 ETH held in a single wallet. AFX offered a 30% bounty.