In another severe blow to decentralized cross-chain infrastructure, decentralized perpetual derivatives exchange AFX Trade (Anti-Fragile Exchange) was exploited for $24.15 million late Wednesday after attackers compromised the private keys of its custom bridge validator network.
How the Incident Unfolded
Security firm Blockaid first detected the unauthorized activity at approximately 21:30 UTC on July 22, identifying malicious transactions originating from the custom bridge contract operated by AFX on Arbitrum.
According to security analysts, the breach was caused by a key management compromise rather than a flaw in smart contract logic. Attackers obtained five hot-validator signatures—reaching the bridge’s two-thirds quorum requirement to sign off on transactions—allowing them to authorize a massive withdrawal of 24.15 million USDC.
Before the exploit, DefiLlama data showed the contract held roughly $24.2 million in USDC, meaning the attacker managed to drain virtually the entire liquidity pool in a single operation.
Arbitrum Native Bridge Remains Unaffected
The incident caused brief concern regarding Arbitrum’s broader ecosystem, but developers quickly clarified that the layer-2 network itself was not compromised.
Steven Goldfeder, co-founder of Arbitrum developer Offchain Labs, addressed the ecosystem on X (formerly Twitter):
“We can confirm that the transaction in question originated from a third-party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way. We will coordinate with the third-party team and will report more details when we have them.”
Path of the Stolen Funds
On-chain analytics firm Lookonchain reported that after executing the unauthorized withdrawal, the attacker bridged the stolen USDC to the Ethereum mainnet. The funds were then rapidly swapped for 12,467 ETH at an average price of $1,937 per token, where they currently remain parked in a single wallet address.
A Pattern of Cross-Chain Vulnerabilities
AFX Trade, which offers USDC-margined perpetual trading with up to 100x leverage across crypto assets and commodities, relies on its custom bridge to process user deposits onto its protocol.
The exploit marks another major security setback for derivatives protocols on Arbitrum this month, coming just days after perps exchange Ostium suffered an $18 million oracle manipulation attack on July 15. It also occurred almost simultaneously with a separate $7.5 million exploit on the Verus Ethereum Bridge, resulting in over $31.6 million stolen across cross-chain infrastructure within a seven-hour window.
Markets have remained relatively stable following the breach. ETH traded flat around $1,928, while ARB held near $0.0806.
At the time of writing, AFX Trade has yet to release a formal post-mortem or publi
