AFX Trade's Bridge Exploited for $24M in USDC on Arbitrum

A bridge vulnerability on Arbitrum-based protocol AFX Trade was used to drain roughly $24.15 million in USD Coin (USDC) on July 22 in an attack that blockchain security firms confirmed was contained to AFX's own infrastructure.

Blockchain security firm Blockaid was among the first to identify the breach, noting the exploit was specific to a bridge that AFX Trade operates rather than any shared or network-level infrastructure. Blockaid said it began coordinating with the Arbitrum team immediately after detecting the incident.

Stolen Funds Moved to Ethereum

After draining the USDC, the attacker moved the stolen assets from Arbitrum to Ethereum and converted them into 12,467 ETH, valued at approximately $24 million at the time of the swap, according to

security firm PeckShield.

Steven Goldfeder, CEO of Offchain Labs, the company that develops Arbitrum, addressed the situation on X. He said the transaction originated from a third-party protocol and that Arbitrum's native bridge was not involved in the attack. Goldfeder said the Offchain Labs team would work alongside AFX and report further details as the investigation continued.

AFX Trade separately confirmed it detected the breach and suspended its bridge operations in response. In a statement, the team said its trading infrastructure and mainnet were not affected, and described the incident as isolated to the AFX-operated custody bridge.