AFX Trade loses $24 million in bridge exploit as attacker compromises validator keys on Arbitrum

On July 22, 2026, decentralized exchange AFX Trade was drained of $24.15 million in USDC after an attacker compromised the validator signing keys of its third-party bridge. The attacker used five compromised hot-validator signatures to clear the bridge's quorum and withdraw nearly all of its locked funds. The stolen USDC was converted into 12,467 ETH on Ethereum. While Arbitrum's native bridge was unaffected, the exploit highlights ongoing security vulnerabilities in cross-chain bridge infrastructure.

AFX bridge exploit

• ▪AFX Trade was drained of approximately $24.15 million in USDC on July 22, 2026, after an attacker targeted its third-party cross-chain bridge
• ▪The $24.15 million drained in the exploit represented almost the entirety of AFX Trade's total value locked.

Validator key compromise

• ▪The exploit was executed by compromising the private validator signing keys behind AFX Trade's proprietary bridge
• ▪Five hot-validator signatures, representing 7,142 of the bridge's 10,000 validator-power units, authorized the withdrawal to clear the required two-thirds quorum
• ▪The bridge contract released the funds to the attacker's wallet after a roughly 200-second dispute window.

Stolen funds conversion

• ▪The attacker bridged the stolen USDC to Ethereum and swapped it into approximately 12,467 ETH at an average price of $1,937
• ▪The converted ETH was traced by security firms to a single Ethereum wallet address, 0x6276…ebAC.

Fund tracing efforts

• ▪Security firm Blockaid detected the exploit at approximately 9:30 p.m. UTC on July 22, 2026, and began tracing the stolen funds
• ▪AFX Trade head of growth Ken C extended a white hat settlement offer allowing the hacker to keep 30% of the stolen funds if they return 70%

Arbitrum investigation response

• ▪AFX Trade suspended its bridge operations upon detecting the security incident and confirmed its trading infrastructure and mainnet remained uncompromised.
• ▪Offchain Labs co-founder Steven Goldfeder confirmed that the Arbitrum native bridge was not compromised or affected by the exploit.

Cross-chain bridge security incidents

• ▪The AFX Trade exploit marks the 14th crypto security incident in July 2026, pushing monthly losses to approximately $97 million
• ▪The incident follows other recent Arbitrum-related security events, including an $18 million oracle exploit on Ostium and a $292 million exploit on Kelp DAO