Verify a decision

{"actor":"system:backfill","investigation_id":"c04af338-acfd-4028-b18d-e72591b52534","kind":"publish","page_slug":"afx-trade","published_at":"2026-07-24T23:03:49.849Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"AFX Trade","sections":[{"content":"At approximately 21:30 UTC on July 22, 2026, an unknown attacker drained 24,150,000 USDC from the AFX-operated USDC custody bridge on Arbitrum. Security firm Blockaid detected the exploit and confirmed that the on-chain logic was not bypassed — rather, five validator signing keys controlling the bridge's withdrawal authorization mechanism were compromised, allowing the attacker to fraudulently satisfy the multi-signature quorum required to approve a withdrawal. The dispute window before finalization was approximately 200 seconds, which the attacker exploited. After the withdrawal was authorized and finalized, the attacker bridged the stolen USDC from Arbitrum to Ethereum and converted the proceeds into approximately 12,467.5 ETH at a price of roughly $1,937 per ETH. Funds were consolidated into a single Ethereum wallet identified by on-chain trackers and PeckShield as 0x6276...ebAC. DefiLlama classified the incident under technique 'Private Key Compromised' within the 'Infrastructure' attack category. Zellic, a security firm that had previously audited the bridge code, was invited to assist in the post-incident investigation. Steven Goldfeder, co-founder of Offchain Labs (the team behind Arbitrum), publicly clarified that the Arbitrum native bridge 'has not been hacked or exploited in any way,' characterizing the incident as originating from a third-party protocol rather than the underlying Layer 2 network.","heading":"The July 2026 Bridge Exploit","severity":"critical","sources":[{"credibility":2,"name":"Arbitrum protocol AFX Trade hit by $24 million bridge exploit: Blockaid — The Block","type":"news_article","url":"https://www.theblock.co/post/409482/arbitrum-protocol-afx-trade-exploit"},{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":2,"name":"AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH — crypto.news","type":"news_article","url":"https://crypto.news/afx-bridge-exploit-drains-24-15m-usdc-as-attacker-buys-12467-eth/"},{"credibility":2,"name":"AFX Trade Hack: Compromised Bridge Keys Drain $24 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/afx-trade-hack-compromised-bridge-keys-24m"},{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"}]},{"content":"The exploited component was AFX Trade's proprietary USDC custody bridge, a third-party infrastructure layer built on top of Arbitrum. The bridge used a multi-signature validator model requiring a quorum of five signatures to authorize withdrawals. The attacker obtained or compromised a sufficient number of private validator hot keys to fraudulently satisfy this quorum — Blockaid confirmed the on-chain contracts functioned as designed and that the vulnerability was in the off-chain key management rather than in smart contract code. The bridge held approximately $24.18 million in USDC at the time of the exploit, representing substantially all of the bridge's total value locked. The 200-second dispute window before transaction finalization did not provide sufficient time to detect and halt the transaction. Security firm Zellic, which had previously conducted an audit of the bridge code, joined the investigation. The exact attack vector — whether it involved phishing, supply chain compromise, insider access, or other means of extracting private keys — remained under investigation as of the date of initial reporting.","heading":"Technical Analysis: Bridge Architecture and Vulnerability","severity":"critical","sources":[{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":3,"name":"AFX Trade Bridge Exploit Drains $24.15M USDC on Arbitrum — NFT Plazas","type":"news_article","url":"https://nftplazas.com/afx-trade-bridge-exploit-drains-24-15m-usdc-on-arbitrum/"},{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"}]},{"content":"AFX Trade stated it immediately suspended bridge operations upon detecting the incident and initiated incident response procedures. The protocol described the damage as 'isolated to the AFX-operated custody bridge,' asserting that its trading infrastructure, AFX mainnet, and the Arbitrum network itself remained uncompromised. AFX's head of growth, identified as Ken C, publicly offered the attacker a white-hat settlement: return 70% of the stolen funds and retain the remaining 30% (approximately $7.2 million) as a bounty. As of initial reporting, no funds had been recovered and the attacker had not responded to the public offer. The Crypto Defense Alliance and multiple exchanges were reported to be monitoring the attacker's wallet for any outbound asset movements.","heading":"AFX Trade's Incident Response and White-Hat Bounty Offer","severity":"high","sources":[{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"}]},{"content":"The AFX Trade exploit occurred on a single day that saw three separate bridge-related attacks across the DeFi ecosystem, totaling $35.55 million in combined losses. In addition to the AFX Trade breach ($24.15 million), the Verus Ethereum bridge was exploited for approximately $7.55 million in what was described as a repeat attack, and B² Network suffered a $3.86 million loss. Blockchain security firm Blockaid characterized July 23, 2026 as 'Hackers Day' in reference to the clustering of incidents. Crypto industry analysts noted that these incidents reinforce a documented pattern in which cross-chain bridging infrastructure — rather than native Layer 1 or Layer 2 code — represents the most frequently targeted attack surface in DeFi. Monthly losses from hacks across the broader crypto sector reached approximately $97 million in July 2026 based on available reporting at the time. The AFX Trade exploit was the largest single incident among the day's attacks.","heading":"Broader Context: July 23, 2026 Clustered Bridge Exploits","severity":"high","sources":[{"credibility":2,"name":"Crypto's 'Hackers Day': AFX Trade Hit for $24M, Losses Reach $35.55M — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/cryptos-hackers-day-afx-trade-hit-for-24m-losses-reach-35-55m/"},{"credibility":2,"name":"Crypto Bridge Attack Spree: $31M Stolen From AFX and VerusCoin — Live Bitcoin News","type":"news_article","url":"https://www.livebitcoinnews.com/crypto-bridge-attack-spree-31m-stolen-from-afx-and-veruscoin/"},{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"}]},{"content":"AFX Trade operates as a decentralized perpetual futures exchange on Arbitrum. The protocol features a fully on-chain central limit order book (CLOB) with on-chain matching and settlement, zero-gas execution, and MEV-resistant design. It uses its proprietary ClearEng risk engine and settles positions in USDC. The platform competes in the on-chain perp DEX market alongside protocols such as Hyperliquid. Prior to the July 2026 exploit, the protocol had accumulated approximately $24.18 million in TVL through its bridge infrastructure. Limited public information is available regarding the protocol's founding team, launch date, or investor backing. The only named team member identified in post-exploit reporting is Ken C, described as AFX's head of growth.","heading":"Protocol Background","severity":"medium","sources":[{"credibility":2,"name":"AFX Trade Exploited for $24 Million in Bridge Attack on Arbitrum — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/afx-trade-exploited-24-million-014055064.html"},{"credibility":3,"name":"AFX Trade Hack: Arbitrum Perp DEX Loses $24M as Bridge Keys Are Compromised — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/afx-trade-hack-bridge-exploit-arbitrum/"}]},{"content":"Following the exploit, blockchain analytics firms PeckShield and Blockaid tracked the movement of stolen assets. The attacker's wallet, partially identified as 0x6276...ebAC on Ethereum, received approximately 12,467.5 ETH converted from the stolen 24,150,000 USDC. The stolen funds were bridged from Arbitrum to Ethereum before conversion. At least one report alleged that PeckShieldAlert detected movements toward Tornado Cash, though this was not confirmed by multiple sources and should be treated as low-confidence. The Crypto Defense Alliance coordinated surveillance efforts alongside multiple centralized exchanges to flag any deposits from the attacker's known address.","heading":"On-Chain Asset Tracing","severity":"high","sources":[{"credibility":3,"name":"AFX Trade and VerusCoin bridges exploited for $31 million in July 2026 — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/afx-trade-and-veruscoin-bridges-exploited-for-31-million-in-july-2026/"},{"credibility":3,"name":"AFX Trade Exploit Drains $24 Million as Attacker Bridges Stolen Funds to Ethereum — CryptoWisser","type":"news_article","url":"https://www.cryptowisser.com/news/afx-trade-exploit-drains-24m-usd-as-attacker-bridges-stolen-funds-to-ethereum/"},{"credibility":2,"name":"AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH — crypto.news","type":"news_article","url":"https://crypto.news/afx-bridge-exploit-drains-24-15m-usdc-as-attacker-buys-12467-eth/"}]}],"sources_used":[{"credibility":2,"name":"Arbitrum protocol AFX Trade hit by $24 million bridge exploit: Blockaid — The Block","type":"news_article","url":"https://www.theblock.co/post/409482/arbitrum-protocol-afx-trade-exploit"},{"credibility":1,"name":"Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised"},{"credibility":2,"name":"Crypto's 'Hackers Day': AFX Trade Hit for $24M, Losses Reach $35.55M — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/cryptos-hackers-day-afx-trade-hit-for-24m-losses-reach-35-55m/"},{"credibility":2,"name":"Arbitrum Perp DEX AFX Trade Drained of $24M, Offers Hacker 30% to Return It — Decrypt","type":"news_article","url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"credibility":2,"name":"AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"credibility":2,"name":"AFX bridge exploit drains $24.15M USDC as attacker buys 12,467 ETH — crypto.news","type":"news_article","url":"https://crypto.news/afx-bridge-exploit-drains-24-15m-usdc-as-attacker-buys-12467-eth/"},{"credibility":2,"name":"AFX Trade Hack: Compromised Bridge Keys Drain $24 Million — CryptoDaily","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/afx-trade-hack-compromised-bridge-keys-24m"},{"credibility":2,"name":"Why AFX Trade's $24.15M hack is another warning for crypto bridges — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"},{"credibility":2,"name":"AFX Trade Exploited for $24 Million in Bridge Attack on Arbitrum — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/afx-trade-exploited-24-million-014055064.html"},{"credibility":3,"name":"AFX Trade Bridge Exploit Drains $24.15M USDC on Arbitrum — NFT Plazas","type":"news_article","url":"https://nftplazas.com/afx-trade-bridge-exploit-drains-24-15m-usdc-on-arbitrum/"},{"credibility":3,"name":"Crypto Bridge Attack Spree: $31M Stolen From AFX and VerusCoin — Live Bitcoin News","type":"news_article","url":"https://www.livebitcoinnews.com/crypto-bridge-attack-spree-31m-stolen-from-afx-and-veruscoin/"},{"credibility":3,"name":"AFX Trade and VerusCoin bridges exploited for $31 million in July 2026 — CoinTurk","type":"news_article","url":"https://en.coin-turk.com/afx-trade-and-veruscoin-bridges-exploited-for-31-million-in-july-2026/"},{"credibility":3,"name":"AFX Trade Hack: Arbitrum Perp DEX Loses $24M as Bridge Keys Are Compromised — CryptoTicker","type":"news_article","url":"https://cryptoticker.io/en/afx-trade-hack-bridge-exploit-arbitrum/"}],"summary":"AFX Trade is a decentralized perpetual futures exchange (perp DEX) built on Arbitrum that uses a fully on-chain central limit order book (CLOB) and settles in USDC. On July 22–23, 2026, the protocol suffered a $24.15 million loss after attackers compromised the private validator signing keys controlling its third-party USDC custody bridge, fraudulently meeting the multi-signature threshold required to authorize a withdrawal. The incident represents one of three clustered bridge exploits on the same day, which collectively drained $35.55 million across the DeFi ecosystem.","timeline":[{"date":"2026-07-22","event":"Attacker compromises five validator signing keys controlling AFX Trade's USDC custody bridge on Arbitrum. At 21:30 UTC, a fraudulent withdrawal of 24,150,000 USDC is authorized by meeting the multi-signature quorum threshold. Blockaid detects the exploit at the same timestamp.","source":"The Block / CoinDesk","source_url":"https://www.theblock.co/post/409482/arbitrum-protocol-afx-trade-exploit"},{"date":"2026-07-22","event":"The attacker bridges the stolen 24.15 million USDC from Arbitrum to Ethereum and converts the funds into approximately 12,467.5 ETH at roughly $1,937 per ETH. PeckShield identifies the attacker's Ethereum wallet as 0x6276...ebAC.","source":"crypto.news / CryptoTimes","source_url":"https://crypto.news/afx-bridge-exploit-drains-24-15m-usdc-as-attacker-buys-12467-eth/"},{"date":"2026-07-23","event":"AFX Trade suspends bridge operations and issues a public statement confirming the exploit, stating the damage is 'isolated to the AFX-operated custody bridge.' Offchain Labs co-founder Steven Goldfeder publicly clarifies the Arbitrum native bridge was not affected.","source":"Decrypt / CryptoBriefing","source_url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it"},{"date":"2026-07-23","event":"AFX Trade head of growth Ken C publicly offers the attacker a white-hat settlement: return 70% of the stolen funds and keep 30% (approximately $7.2 million) as a bounty. No response from the attacker is reported.","source":"Decrypt / CryptoBriefing","source_url":"https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/"},{"date":"2026-07-23","event":"Two additional bridge exploits occur on the same day: the Verus Ethereum bridge ($7.55 million) and B² Network ($3.86 million), bringing total single-day losses to $35.55 million. Blockaid characterizes the day as 'Hackers Day.'","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/23/cryptos-hackers-day-afx-trade-hit-for-24m-losses-reach-35-55m/"},{"date":"2026-07-23","event":"Zellic, the security firm that had previously audited the AFX bridge code, joins the post-incident investigation. The Crypto Defense Alliance and multiple exchanges begin monitoring the attacker's wallet for outbound movements.","source":"AMBCrypto","source_url":"https://ambcrypto.com/why-afx-trades-24-15m-hack-is-another-warning-for-crypto-bridges/"}]},"v":1}