Audit log

Every state-changing event for AFX Trade Bridge Exploit (July 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-28 17:11:49Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   3ggDFvBfXMLF…5Dc9ZTXWcopysha256 → base58

   verifying row…

   canonical bytes (21084 B) ▸

   {"actor":"system:backfill","investigation_id":"61178b94-c92d-4497-af52-c2ae8330efc7","kind":"publish","page_slug":"afx-trade-bridge-exploit-july-2026","published_at":"2026-07-28T17:11:49.344Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AFX Trade Bridge Exploit (July 2026)","sections":[{"content":"AFX Trade (also referred to as AFX, short for Anti-Fragile Exchange) is a decentralized perpetual futures exchange operating on the Arbitrum Layer 2 network. The protocol settles positions in USDC and offers leveraged trading on crypto assets, equities, ETFs, and commodities, with leverage reportedly as high as 100x. AFX Trade describes itself as community-built without venture capital or private investor backing, with governance tokens distributed at a Token Generation Event (TGE). The protocol operates its own custom USDC custody bridge connecting Arbitrum to Ethereum, separate from Arbitrum's native bridge infrastructure. No named founders have been publicly identified in reporting reviewed for this investigation; a team member identified as 'Ken C' (head of growth) and another identified by the handle 'Supercube' made public statements following the exploit.","heading":"Protocol Overview","severity":"medium","sources":[{"credibility":2,"name":"AFX Trade official website","type":"official","url":"https://www.afx.xyz/"},{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"credibility":2,"name":"Where Is the Perp-DEX Market Heading? Insights from AFX Contributors — ForkLog","type":"news_article","url":"https://forklog.com/en/where-is-the-perp-dex-market-heading-insights-from-afx-contributors/"}]},{"content":"On July 22, 2026, at approximately 21:30 UTC, blockchain security firm Blockaid detected an unauthorized withdrawal from AFX Trade's USDC custody bridge on Arbitrum. According to Blockaid, the attacker obtained the private signing keys of five hot-wallet validators operating the bridge. With five compromised keys, the attacker assembled sufficient signatures to meet the bridge's approximately two-thirds quorum requirement for authorizing withdrawals. The bridge's smart contract incorporated a roughly 200-second challenge period before finalizing transactions; no challenge was filed during this window, and the contract automatically validated the withdrawal, releasing $24.15 million in USDC. Blockaid confirmed that the bridge's on-chain logic functioned as designed — no smart contract code was bypassed or exploited. The root cause was entirely off-chain: the compromise of validator hot keys. How the keys were obtained had not been publicly disclosed as of late July 2026. Security firms SlowMist and Zellic (which had previously audited the bridge's code) were engaged to conduct a technical post-mortem. One search result attributed the access to 'coordinated social engineering and infrastructure compromise, with access appearing to begin in a development environment before escalating into internal build infrastructure and validator systems,' though this characterization was not confirmed by primary statements from AFX or the investigating security firms at time of writing.","heading":"Exploit: Attack Vector and Execution","severity":"critical","sources":[{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"credibility":2,"name":"AFX Trade Halts Bridge Operations After $24.15M USDC Withdrawal — ForkLog","type":"news_article","url":"https://forklog.com/en/afx-trade-halts-bridge-operations-after-24-15m-usdc-withdrawal/"},{"credibility":2,"name":"AFX Trade Hack: Compromised Bridge Keys Drain $24 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/afx-trade-hack-compromised-bridge-keys-24m"},{"credibility":1,"name":"Arbitrum protocol AFX Trade hit by $24 million bridge exploit: Blockaid — The Block","type":"news_article","url":"https://www.theblock.co/post/409482/arbitrum-protocol-afx-trade-exploit"}]},{"content":"Following the unauthorized withdrawal of $24.15 million in USDC from the AFX bridge on Arbitrum, the attacker bridged the stolen funds to the Ethereum mainnet and converted them to approximately 12,467.5 ETH at an average price of approximately $1,937 per ETH. On-chain analysts PeckShield and SlowMist identified the stolen funds as consolidated in a single Ethereum wallet partially identified as 0x6276...ebAC. The conversion from USDC to ETH eliminated the possibility of a USDC freeze by Circle, complicating recovery efforts. As of late July 2026, the funds remained in the identified wallet under active on-chain surveillance by SlowMist, Blockaid, and exchanges alerted through the Crypto Defense Alliance (CDA). No onward movement of the ETH had been reported at time of writing.","heading":"Fund Movements","severity":"critical","sources":[{"credibility":2,"name":"AFX Trade Exploited for $24 Million in Bridge Attack on Arbitrum — BeInCrypto","type":"news_article","url":"https://beincrypto.com/afx-arbitrum-bridge-exploit-24m/"},{"credibility":3,"name":"PeckShieldAlert on X","type":"social_media","url":"https://x.com/PeckShieldAlert/status/2080088731558801909"},{"credibility":2,"name":"AFX Trade Bridge Exploit Drains $24.15M USDC on Arbitrum — NFT Plazas","type":"news_article","url":"https://nftplazas.com/afx-trade-bridge-exploit-drains-24-15m-usdc-on-arbitrum/"},{"credibility":2,"name":"AFX Trade Halts Bridge Operations After $24.15M USDC Withdrawal — ForkLog","type":"news_article","url":"https://forklog.com/en/afx-trade-halts-bridge-operations-after-24-15m-usdc-withdrawal/"}]},{"content":"AFX Trade suspended bridge operations immediately upon detection of the exploit. AFX's head of growth, identified as Ken C (in some reports) and Supercube (in others), publicly offered the attacker a time-limited white-hat settlement: return 70% of stolen funds (approximately $16.9 million) and retain 30% (approximately $7.2 million) as a bounty. This negotiation approach — sometimes called a 'white-hat bounty' — has become increasingly common following large DeFi exploits. The Crypto Defense Alliance (CDA) was notified and provided with wallet data for coordinated monitoring across exchanges. Security firms SlowMist and Zellic were engaged to assist in the investigation; Zellic had previously conducted an audit of the bridge's code. As of late July 2026, no formal post-mortem had been published, no compensation plan for affected users had been announced, and no timeline for bridge resumption had been provided.","heading":"Protocol Response and Bounty Offer","severity":"high","sources":[{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"credibility":2,"name":"AFX Trade Loses $24M in Bridge Exploit, Offers Hacker 30% Bounty — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/afx-trade-loses-24m-in-bridge-exploit-offers-hacker-30-bounty"},{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"credibility":2,"name":"AFX Trade Halts Bridge Operations After $24.15M USDC Withdrawal — ForkLog","type":"news_article","url":"https://forklog.com/en/afx-trade-halts-bridge-operations-after-24-15m-usdc-withdrawal/"}]},{"content":"Multiple news outlets and official sources clarified that the exploit targeted AFX Trade's own proprietary USDC custody bridge, not Arbitrum's native bridge infrastructure. Steven Goldfeder, co-founder of Offchain Labs (the company behind Arbitrum), stated publicly that 'the Arbitrum native bridge has not been hacked or exploited in any way' and that the transaction 'originated from a third-party protocol.' Blockaid similarly confirmed the exploit was isolated to AFX's own bridge operations.","heading":"Arbitrum Network Scope Clarification","severity":"low","sources":[{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"}]},{"content":"The AFX Trade exploit occurred as part of what Blockaid labeled a 'Hackers Day' cluster of coordinated attacks on July 22–23, 2026. Three separate exploits occurred within a 24-hour window with combined losses of approximately $35.55 million: AFX Trade ($24.15 million), the Verus Ethereum Bridge ($7.54–$7.55 million), and B-Squared Network, a Bitcoin Layer 2 ($3.86 million). The AFX and Verus attacks alone accounted for $31.5–$31.7 million and occurred within seven hours of each other. Reporting by CryptoTimes noted that combined losses for the week of July 22–26, 2026 — including subsequent attacks on Wanchain — exceeded $47 million. Total July 2026 crypto hack losses were estimated at approximately $97 million as of late July, surpassing June 2026 losses of approximately $75.32 million. Analysts noted that cross-chain bridge infrastructure remained the most frequently targeted attack surface in DeFi, with validator key management and multisig quorum design representing concentrated single points of failure. A comparable attack methodology was noted in relation to the Verus-Ethereum bridge incident in May 2026.","heading":"Broader Context: July 2026 Bridge Hack Cluster","severity":"high","sources":[{"credibility":2,"name":"Two Cross-Chain Bridges Hacked in One Day — $31.5M Lost — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/bridge-hacks-july/"},{"credibility":2,"name":"Crypto's 'Hackers Day': AFX Trade Hit for $24M, Losses Reach $35.55M — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/cryptos-hackers-day-afx-trade-hit-for-24m-losses-reach-35-55m/"},{"credibility":2,"name":"Crypto Loses Over $47M in a Week as AFX Trade, Wanchain, Verus Get Hacked — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"},{"credibility":2,"name":"AFX Bridge Exploit Drains $24 Million as July Crypto Hack Losses Near $100 Million — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/e911c-afx-bridge-exploit-drains-24-million-as-july-crypto-hack-losses-near-100-million"},{"credibility":2,"name":"Crypto Bridge Attack Spree: $31M Stolen From AFX and VerusCoin — Live Bitcoin News","type":"news_article","url":"https://www.livebitcoinnews.com/crypto-bridge-attack-spree-31m-stolen-from-afx-and-veruscoin/"}]},{"content":"The AFX Trade exploit illustrates known structural vulnerabilities in cross-chain bridge designs that rely on hot-wallet validator key sets and quorum-based authorization. Key risk factors identified by security analysts include: (1) Use of hot validator keys rather than cold or hardware-security-module-backed key storage increases exposure to remote compromise. (2) A two-thirds quorum threshold, while standard, provided insufficient protection once five of the validator keys were simultaneously compromised. (3) A 200-second challenge period with no automated monitoring or alert system allowed the transaction to finalize without human intervention. (4) The concentrated TVL — nearly the entire bridge balance — in a single withdrawable pool amplified loss severity. Security commentary noted parallels to the April 2026 Drift Protocol loss (reported at $285 million), where attackers also gained privileged infrastructure access rather than exploiting smart contract code. The Zellic audit of the bridge code had not identified the key management deficiency as an exploitable path, suggesting the vulnerability resided in operational security rather than contract logic.","heading":"Structural Risk Factors","severity":"high","sources":[{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"},{"credibility":2,"name":"AFX Trade Hack: Arbitrum Perp DEX Loses $24M as Bridge Keys Are Compromised — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/afx-trade-hack-bridge-exploit-arbitrum/"},{"credibility":2,"name":"Arbitrum AFX Exploit Drains $24 Million in Bridge Hack — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/23/arbitrum-afx-exploit-bridge/"}]}],"sources_used":[{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":1,"name":"Arbitrum protocol AFX Trade hit by $24 million bridge exploit: Blockaid — The Block","type":"news_article","url":"https://www.theblock.co/post/409482/arbitrum-protocol-afx-trade-exploit"},{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"credibility":2,"name":"AFX Trade Exploited for $24 Million in Bridge Attack on Arbitrum — BeInCrypto","type":"news_article","url":"https://beincrypto.com/afx-arbitrum-bridge-exploit-24m/"},{"credibility":2,"name":"AFX Trade Exploited for $24 Million in Bridge Attack on Arbitrum — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/afx-trade-exploited-24-million-014055064.html"},{"credibility":2,"name":"AFX Trade Halts Bridge Operations After $24.15M USDC Withdrawal — ForkLog","type":"news_article","url":"https://forklog.com/en/afx-trade-halts-bridge-operations-after-24-15m-usdc-withdrawal/"},{"credibility":2,"name":"AFX Trade Hack: Compromised Bridge Keys Drain $24 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/afx-trade-hack-compromised-bridge-keys-24m"},{"credibility":2,"name":"Two Cross-Chain Bridges Hacked in One Day — $31.5M Lost — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/bridge-hacks-july/"},{"credibility":2,"name":"Crypto's 'Hackers Day': AFX Trade Hit for $24M, Losses Reach $35.55M — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/cryptos-hackers-day-afx-trade-hit-for-24m-losses-reach-35-55m/"},{"credibility":2,"name":"Crypto Loses Over $47M in a Week as AFX Trade, Wanchain, Verus Get Hacked — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"},{"credibility":2,"name":"AFX Bridge Exploit Drains $24 Million as July Crypto Hack Losses Near $100 Million — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/e911c-afx-bridge-exploit-drains-24-million-as-july-crypto-hack-losses-near-100-million"},{"credibility":2,"name":"Crypto Bridge Attack Spree: $31M Stolen From AFX and VerusCoin — Live Bitcoin News","type":"news_article","url":"https://www.livebitcoinnews.com/crypto-bridge-attack-spree-31m-stolen-from-afx-and-veruscoin/"},{"credibility":2,"name":"AFX Trade Loses $24M in Bridge Exploit, Offers Hacker 30% Bounty — KuCoin","type":"news_article","url":"https://www.kucoin.com/news/flash/afx-trade-loses-24m-in-bridge-exploit-offers-hacker-30-bounty"},{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"},{"credibility":2,"name":"AFX Trade Bridge Exploit Drains $24.15M USDC on Arbitrum — NFT Plazas","type":"news_article","url":"https://nftplazas.com/afx-trade-bridge-exploit-drains-24-15m-usdc-on-arbitrum/"},{"credibility":2,"name":"AFX Trade Hack: Arbitrum Perp DEX Loses $24M as Bridge Keys Are Compromised — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/afx-trade-hack-bridge-exploit-arbitrum/"},{"credibility":2,"name":"Arbitrum AFX Exploit Drains $24 Million in Bridge Hack — Cryptonomist","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/23/arbitrum-afx-exploit-bridge/"},{"credibility":3,"name":"PeckShieldAlert on X","type":"social_media","url":"https://x.com/PeckShieldAlert/status/2080088731558801909"},{"credibility":2,"name":"AFX Trade official website","type":"official","url":"https://www.afx.xyz/"}],"summary":"AFX Trade, a decentralized perpetuals exchange (perp DEX) built on Arbitrum and settling positions in USDC, suffered a $24.15 million exploit on July 22, 2026, when an attacker compromised the private keys of five hot-wallet validators operating the protocol's custom USDC custody bridge. The stolen USDC was bridged to Ethereum and converted to approximately 12,467 ETH, draining nearly the protocol's entire total value locked. AFX Trade suspended bridge operations, offered the attacker a 30% white-hat bounty for return of funds, and engaged security firms SlowMist and Zellic for the investigation; no post-mortem or user compensation plan had been published as of late July 2026.","timeline":[{"date":"2026-07-22","event":"At approximately 21:30 UTC, Blockaid and PeckShield detected an unauthorized withdrawal of $24.15 million USDC from the AFX Trade USDC custody bridge on Arbitrum. The attacker used five compromised hot-validator keys to meet the bridge's quorum requirement.","source":"CoinDesk / The Block","source_url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"date":"2026-07-22","event":"After the 200-second challenge period elapsed without a filed challenge, the bridge's smart contract automatically finalized the withdrawal. The attacker bridged the stolen USDC to Ethereum and converted it to approximately 12,467.5 ETH, consolidating funds in wallet 0x6276...ebAC.","source":"Crypto Briefing / ForkLog","source_url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"date":"2026-07-22","event":"AFX Trade suspended bridge operations. A second exploit, targeting the Verus Ethereum Bridge for approximately $7.54 million, occurred within seven hours of the AFX exploit as part of what Blockaid called 'Hackers Day.'","source":"Bitcoin Foundation / CryptoTimes","source_url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/bridge-hacks-july/"},{"date":"2026-07-23","event":"AFX's head of growth (identified as Ken C / Supercube) publicly offered a time-limited white-hat bounty: the attacker may retain 30% (~$7.2 million) if 70% (~$16.9 million) is returned. Arbitrum co-founder Steven Goldfeder confirmed the Arbitrum native bridge was not involved.","source":"Decrypt / CoinDesk","source_url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"date":"2026-07-23","event":"Security firms SlowMist and Zellic (prior bridge auditor) engaged to investigate. Stolen funds reported as still held in the attacker's Ethereum wallet. Crypto Defense Alliance (CDA) and multiple exchanges notified for coordinated monitoring.","source":"ForkLog / CryptoTimes","source_url":"https://forklog.com/en/afx-trade-halts-bridge-operations-after-24-15m-usdc-withdrawal/"},{"date":"2026-07-26","event":"Weekly losses from the bridge hack cluster — including AFX Trade, Verus, and Wanchain — reported to exceed $47 million. AFX had still not published a post-mortem, compensation plan, or bridge resumption timeline.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a2111213-ecd9-4f6e-9f5b-0534b2d5f5d6copy