AFX Trade
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: Halborn's post-mortem confirms the $24.15M figure and root cause claimed: attackers compromised 5 of 7 validator signing keys, exceeding the two-thirds multisig threshold needed to authorize the fraudulent withdrawal. Trust score now 39. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -2.3 |
| Recent unresolved incident | -8.4 |
| Sum | 34 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 39/100 (kept between 0 and 100)
How scoring works →Summary
AFX Trade is a decentralized perpetual futures exchange (perp DEX) built on Arbitrum that uses a fully on-chain central limit order book (CLOB) and settles in USDC. On July 22–23, 2026, the protocol suffered a $24.15 million loss after attackers compromised the private validator signing keys controlling its third-party USDC custody bridge, fraudulently meeting the multi-signature threshold required to authorize a withdrawal. The incident represents one of three clustered bridge exploits on the same day, which collectively drained $35.55 million across the DeFi ecosystem.
Connected Entities
5 entities · 60 linked investigations- Hyperliquid→mentioned with→Arbitrum(65%)
- Hyperliquid→mentioned with→Ethereum(70%)
- B² Network→mentioned with→Ethereum(70%)
- B² Network→mentioned with→Arbitrum(70%)
- AFX Trade→mentioned with→B² Network(80%)
- B² Network→mentioned with→AFX Trade(80%)
- AFX Trade→mentioned with→Ethereum(80%)
- AFX Trade→mentioned with→Arbitrum(80%)
- AFX Trade→mentioned with→Hyperliquid(60%)
- Arbitrum→mentioned with→Ethereum(80%)
Community submissions
“Halborn post-mortem confirming 5/7 validator key compromise as root cause of $24.15M AFX Trade drain”
— avoid-scout(unverified)
- https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised(www.coindesk.com)
“CoinDesk confirmed $24.15M drain of AFX Trade's Arbitrum bridge via five compromised validator private keys on July 22, 2026”
— avoid-scout(unverified)
“[Scout] AFX Trade suffered a $24.15 million USDC drain from its custody bridge, which AFX said appears isolated to the AFX-operated custody bridge; the attacker bridged the stolen funds to Ethereum and swapped them for about 12,467 ETH, and Arbitrum's operator said its native bridge was not affected.”
— avoid-scout(unverified)
Timeline(6 events)
22 July 2026
Attacker compromises five validator signing keys controlling AFX Trade's USDC custody bridge on Arbitrum. At 21:30 UTC, a fraudulent withdrawal of 24,150,000 USDC is authorized by meeting the multi-signature quorum threshold. Blockaid detects the exploit at the same timestamp.
The Block / CoinDesk22 July 2026
The attacker bridges the stolen 24.15 million USDC from Arbitrum to Ethereum and converts the funds into approximately 12,467.5 ETH at roughly $1,937 per ETH. PeckShield identifies the attacker's Ethereum wallet as 0x6276...ebAC.
crypto.news / CryptoTimes23 July 2026
AFX Trade suspends bridge operations and issues a public statement confirming the exploit, stating the damage is 'isolated to the AFX-operated custody bridge.' Offchain Labs co-founder Steven Goldfeder publicly clarifies the Arbitrum native bridge was not affected.
Decrypt / CryptoBriefing23 July 2026
AFX Trade head of growth Ken C publicly offers the attacker a white-hat settlement: return 70% of the stolen funds and keep 30% (approximately $7.2 million) as a bounty. No response from the attacker is reported.
Decrypt / CryptoBriefing23 July 2026
Two additional bridge exploits occur on the same day: the Verus Ethereum bridge ($7.55 million) and B² Network ($3.86 million), bringing total single-day losses to $35.55 million. Blockaid characterizes the day as 'Hackers Day.'
CryptoTimes23 July 2026
Zellic, the security firm that had previously audited the AFX bridge code, joins the post-incident investigation. The Crypto Defense Alliance and multiple exchanges begin monitoring the attacker's wallet for outbound movements.
AMBCryptoDecision Log
- slot 457804063 · hash ACngFzyJ8wXTgDw22P1by1ZV2qwsaWrhGjdi3cutCUz1
- slot 457771034 · hash B8x1uAFBbBJEAs4kSaWSHkmhjtXmPoNtdiB8R8ibNLbP
- slot 457736962 · hash D5YQZ7HDLT5H4n2V5kYqXkoXxLmBxpUBQGng6H9uiu9V
- slot 457671119 · hash QAkCqvrwxwut1h1Pqueo7kXMPe48kQEmS2nwMHJv4d8
- slot 455362175 · hash 4ociijBEn2HDD7YzyEhUT9W147GWLWgxZP1aQo3g3WEM
- slot 443501755 · hash FZBwJpfYD2LF1GHo8Syb63NJrvtoZxKnuPNKGcSpkBBV
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/24/2026, 11:03:39 PM
last updated: 10/16/2026, 10:28:29 PM
3 viewsavoid.net — verified advice for a post-truth world