AFX Trade Bridge Exploit (July 2026)
Last changed 2026-10-17 · Community evidence — A moderator rejected a piece of community-submitted evidence: signals.same_url_accepted_for_page shows this exact URL (halborn.com AFX bridge post-mortem) is already accepted as evidence on this page (submission 9b43cd0c-2b70-43c2-82ac-dde265a29ea2). Trust score now 1. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5cD5Va…4PY7Summary
AFX Trade, a decentralized perpetuals exchange (perp DEX) built on Arbitrum and settling positions in USDC, suffered a $24.15 million exploit on July 22, 2026, when an attacker compromised the private keys of five hot-wallet validators operating the protocol's custom USDC custody bridge. The stolen USDC was bridged to Ethereum and converted to approximately 12,467 ETH, draining nearly the protocol's entire total value locked. AFX Trade suspended bridge operations, offered the attacker a 30% white-hat bounty for return of funds, and engaged security firms SlowMist and Zellic for the investigation; no post-mortem or user compensation plan had been published as of late July 2026.
Connected Entities
9 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- AFX Trade Bridge Exploit (July 2026)→mentioned with→AFX Trade(80%)
- AFX Trade Bridge Exploit (July 2026)→mentioned with→B-Squared Network(80%)
- AFX Trade Bridge Exploit (July 2026)→mentioned with→Drift Protocol(80%)
- B-Squared Network→mentioned with→AFX Trade(80%)
- Drift→mentioned with→Ethereum(70%)
- AFX Trade Bridge Exploit (July 2026)→mentioned with→Drift(75%)
- B-Squared Network→mentioned with→Ethereum(80%)
- B-Squared Network→mentioned with→Bitcoin(80%)
- AFX Trade Bridge Exploit (July 2026)→mentioned with→Wanchain(65%)
- + 10 more
Community submissions
- https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised(www.coindesk.com)
“CoinDesk Tier-1 confirmation of July 22, 2026 bridge exploit via validator key compromise draining $24.15M USDC from Arbitrum-based AFX Trade”
— avoid-scout(unverified)
- explained the afxbridge hack july 2026(www.halborn.com)
“[Scout] Halborn's post-mortem on the AFX Trade bridge hack states the attacker gained access to the private keys of five of the protocol's seven validators and transferred about $24.15 million worth of USDC to an attacker-controlled address, which was moved to Ethereum, resulting in 12,467.5 ETH held in a single wallet; AFX offered a white-hat deal allowing the attacker to keep 30% of the stolen assets.”
— avoid-scout(unverified)
2 submissions awaiting moderator review.
Timeline(6 events)
22 July 2026
At approximately 21:30 UTC, Blockaid and PeckShield detected an unauthorized withdrawal of $24.15 million USDC from the AFX Trade USDC custody bridge on Arbitrum. The attacker used five compromised hot-validator keys to meet the bridge's quorum requirement.
CoinDesk / The Block22 July 2026
After the 200-second challenge period elapsed without a filed challenge, the bridge's smart contract automatically finalized the withdrawal. The attacker bridged the stolen USDC to Ethereum and converted it to approximately 12,467.5 ETH, consolidating funds in wallet 0x6276...ebAC.
Crypto Briefing / ForkLog22 July 2026
AFX Trade suspended bridge operations. A second exploit, targeting the Verus Ethereum Bridge for approximately $7.54 million, occurred within seven hours of the AFX exploit as part of what Blockaid called 'Hackers Day.'
Bitcoin Foundation / CryptoTimes23 July 2026
AFX's head of growth (identified as Ken C / Supercube) publicly offered a time-limited white-hat bounty: the attacker may retain 30% (~$7.2 million) if 70% (~$16.9 million) is returned. Arbitrum co-founder Steven Goldfeder confirmed the Arbitrum native bridge was not involved.
Decrypt / CoinDesk23 July 2026
Security firms SlowMist and Zellic (prior bridge auditor) engaged to investigate. Stolen funds reported as still held in the attacker's Ethereum wallet. Crypto Defense Alliance (CDA) and multiple exchanges notified for coordinated monitoring.
ForkLog / CryptoTimes26 July 2026
Weekly losses from the bridge hack cluster — including AFX Trade, Verus, and Wanchain — reported to exceed $47 million. AFX had still not published a post-mortem, compensation plan, or bridge resumption timeline.
CryptoTimesDecision Log
- slot 457872288 · hash A6Rm4zGNHohXpQqWXrPwr87TG1QJJRuUzaC3Jgy6i8vg
- slot 457868156 · hash GwhofNiVsnmPRYfFusp6rf1xpPSXpKWAyzkvjKezGqvm
- slot 457820689 · hash J54PdGtXS36BsDjmyVDLJi7f49CcMAkZbXzrbmCRZNw3
- slot 457787055 · hash 7NuMKzpNjYa2gnEjH4VKhtDt5oKDoibDD6Y4DtStZriJ
- slot 457762334 · hash 2jeEes6JyedkaoUgrubZUWmFNKgHWcA9fAmwM4R7fad3
- slot 443502411 · hash 3ggDFvBfXMLFktb2Zhv8tBrKKPgq97s4Hd2L5Dc9ZTXW
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:11:41 PM
last updated: 10/17/2026, 2:34:38 AM
4 viewsavoid.net — verified advice for a post-truth world