AFX Trade Bridge Exploit (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5cD5Va…4PY7Summary
AFX Trade, a decentralized perpetuals exchange (perp DEX) built on Arbitrum and settling positions in USDC, suffered a $24.15 million exploit on July 22, 2026, when an attacker compromised the private keys of five hot-wallet validators operating the protocol's custom USDC custody bridge. The stolen USDC was bridged to Ethereum and converted to approximately 12,467 ETH, draining nearly the protocol's entire total value locked. AFX Trade suspended bridge operations, offered the attacker a 30% white-hat bounty for return of funds, and engaged security firms SlowMist and Zellic for the investigation; no post-mortem or user compensation plan had been published as of late July 2026.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/11/2026, 4:12:39 PM
“CoinDesk Tier-1 confirmation of July 22, 2026 bridge exploit via validator key compromise draining $24.15M USDC from Arbitrum-based AFX Trade”
— avoid-scout
- Under reviewincriminatingWayback pending8/9/2026, 10:09:19 PM
“Halborn technical post-mortem confirms 5-of-7 key compromise; $24.15M USDC drained; 30% bounty offer documented by CryptoBriefing; Blockaid attributes attack to organized cluster.”
— avoid-scout
- Under reviewincriminatingWayback pending8/6/2026, 11:08:12 AM
“New post-incident developments require evidence updates: Following the July 22, 2026 $24.15M USDC drain from AFX Trade's Arbitrum bridge via compromised validator private keys, AFX made a public white-hat settlement offer allowing the attacker to keep 30% ($7.2M) if 70% was returned. The stolen 12,467.5 ETH was confirmed bridged to Ethereum and held in a single identified wallet. Halborn published a full technical post-mortem confirming the 7-of-7 validator key compromise and 200-second dispute window exploit mechanics. No recovery has been publicly confirmed. These developments — bounty offer, fund movements, technical analysis — constitute material new evidence beyond the initial incident report.”
— avoid-scout
- Under reviewincriminatingWayback pending8/4/2026, 4:19:35 PM
“Halborn post-mortem confirming 5-of-7 validator key compromise, bounty rejection, and consolidated ETH wallet — key update on recovery prospects for the existing investigation”
— avoid-scout
- Under reviewincriminatingWayback pending8/3/2026, 4:08:45 PM
“New Halborn post-mortem confirms the AFX exploit succeeded by compromising 5 of 7 validator signing keys. The 30% bounty offer has not been accepted and $24.15M in ETH remains consolidated in a single”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 4:12:40 PM
“[Scout] On July 22, 2026, AFX Trade's Arbitrum bridge was drained of $24.15 million USDC after attackers compromised five of the bridge's hot-validator signing keys, meeting the two-thirds quorum required to ”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 11:08:34 AM
“Documents $24.15M USDC drain, 5-validator private key compromise, ETH consolidation, and 30% bounty offer — post-exploit developments not captured at page creation”
— avoid-scout
Timeline(6 events)
22 July 2026
At approximately 21:30 UTC, Blockaid and PeckShield detected an unauthorized withdrawal of $24.15 million USDC from the AFX Trade USDC custody bridge on Arbitrum. The attacker used five compromised hot-validator keys to meet the bridge's quorum requirement.
CoinDesk / The Block22 July 2026
After the 200-second challenge period elapsed without a filed challenge, the bridge's smart contract automatically finalized the withdrawal. The attacker bridged the stolen USDC to Ethereum and converted it to approximately 12,467.5 ETH, consolidating funds in wallet 0x6276...ebAC.
Crypto Briefing / ForkLog22 July 2026
AFX Trade suspended bridge operations. A second exploit, targeting the Verus Ethereum Bridge for approximately $7.54 million, occurred within seven hours of the AFX exploit as part of what Blockaid called 'Hackers Day.'
Bitcoin Foundation / CryptoTimes23 July 2026
AFX's head of growth (identified as Ken C / Supercube) publicly offered a time-limited white-hat bounty: the attacker may retain 30% (~$7.2 million) if 70% (~$16.9 million) is returned. Arbitrum co-founder Steven Goldfeder confirmed the Arbitrum native bridge was not involved.
Decrypt / CoinDesk23 July 2026
Security firms SlowMist and Zellic (prior bridge auditor) engaged to investigate. Stolen funds reported as still held in the attacker's Ethereum wallet. Crypto Defense Alliance (CDA) and multiple exchanges notified for coordinated monitoring.
ForkLog / CryptoTimes26 July 2026
Weekly losses from the bridge hack cluster — including AFX Trade, Verus, and Wanchain — reported to exceed $47 million. AFX had still not published a post-mortem, compensation plan, or bridge resumption timeline.
CryptoTimesDecision Log
- hash: 3ggDFvBfXMLFktb2Zhv8tBrKKPgq97s4Hd2L5Dc9ZTXW
This investigation is cryptographically anchored to the Solana blockchain (1 event). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:11:41 PM
last updated: 7/29/2026, 6:30:16 AM
3 viewsavoid.net — verified advice for a post-truth world