Hackers Drain $24.15 Million in USDC From AFX Bridge on Arbitrum Exploiting Compromised Validator Keys
Cross-chain protocol AFX lost $24.15 million in USDC after an attacker used compromised validator keys to drain a third-party custody bridge on Arbitrum. The stolen stablecoins were bridged to the Ethereum network and swapped for 12,467 ether, which remain in a single wallet.
The incident underscores vulnerabilities in bridge operators, as a security audit by Zellic flagged the AFX bridge for zero test coverage and unfixed findings. Hours later, other networks including Verus and the B2 Network were similarly drained, bringing total losses across the three protocols to $35 million, according to data aggregated by CoinDesk. Offchain Labs confirmed the compromise was isolated to the AFX bridge and the native Arbitrum bridge remained secure.
From the sources (19 posts)
@officer_secretLooks like there is a USDC bridge possible exploit on Arbitrum! @blockaid_ detected an abnormal bridge withdrawal that extracted ~$24.15M USDC from an Arbitrum USDC custody bridge contract. The on-chain bridge logic was not bypassed; the m
@ethdailyBREAKING: $24 million USDC has been drained from a third-party bridging protocol on Arbitrum. The Arbitrum native bridge and Circle CCTP protocol are not involved. Investigations ongoing 🧵👇
@noxosintelPublic engine detected a possible exploit of the #USDC bridge on #Arbitrum, exceeding $24M. 1. Exploit transaction: 2. The funds were then bridged to the same address on #Ethereum across 6 transactions: https://
@odysseas_ethNew hack: A $24.15M Arbitrum USDC bridge (not CCTP) withdrawal looks like validator-path compromise, not a contract logic bypass. 5 hot-validator signatures carried 7,142/10,000 power (>2/3). After the 200s dispute window, funds were
@blockaid_Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting @AFX_XYZ, a protocol on @arbitrum. The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol. Our team has b
@officer_secretAccording to @peckshield , there is an abnormal bridge withdrawal that extracted ~$24.15M USDC from an Arbitrum USDC custody bridge contract. The on-chain bridge logic was not bypassed; the malicious withdrawal was authorized by a quorum of
@peckshieldalert#PeckShieldAlert @AFX_XYZ on #Arbitrum has been exploited for ~$24M USDC. The exploiter has bridged the stolen funds from #Abitrum to #Ethereum and swapped them for 12,467.5 $ETH, currently sitting in 0x6276...ebAC.
@wublockchainAFX-Operated Bridge Loses $24.15 Million in USDC Exploit Onchain security firm Blockaid said it detected an attack on a cross-chain bridge operated by Arbitrum-based protocol AFX at 21:30 UTC on July 22, with about 24.15 million USDC stole
@cointelegraph🚨 ALERT: Blockaid detected a ~24.15M $USDC exploit on AFX, a third-party bridge protocol on Arbitrum. Offchain Labs co-founder Steven Goldfeder says the native Arbitrum bridge itself was not hacked or exploited and they are investigating.
@arbitrumRT @sgoldfed: We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question o…
@lookonchainAFX Trade(@AFX_XYZ) was exploited for $24.15M! The exploiter bridged 24.15M $USDC to #Ethereum and bought 12,467 $ETH at an average price of $1,937.
@theblockcoNEW: AFX Trade, a protocol on Arbitrum, has suffered an exploit with roughly 24.15M USDC drained, according to Blockaid. Offchain Labs' Steven Goldfeder says the Arbitrum team is investigating the incident and confirmed that the Arbitrum n
@kalshi_cryptoJUST IN: Arbitrum-based perp DEX AFX exploited for $24M
@zookoRT @sgoldfed: We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question o…
@laurashinRT @sgoldfed: We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question o…
@cyversalerts🚨ALERT🚨Our system has detected a suspicious transaction involving @AFX_XYZ, resulting in a loss of 24.1M ethereum:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 on the #Arbitrum network. Root cause: suspected compromise of validator keys. The
@tayvano_I read the AFX Bridge audit. Zellic did a great job (per usual) Their findings are fucking terrifying though. Zero test coverage. Lots of acks without fixes. Zellic couldn’t even run the thing bc they were just given bits and pieces. 😱
@tayvano_oh good AFX has finally arrived to deal with their incident. they says "hold my beer i can out-retard you!" and come out the gate with a whopping 30% bounty offer. 😳
@alliedmasterexethree cross-chain protocols bled out in a single trading window. afx trade on arbitrum lost 24.15 million usdc after an attacker assembled enough hot-validator signatures to approve the withdrawal. offchain labs confirmed the native bridge