An attacker drained approximately $24.15 million in USDC from a bridge contract operated by derivatives exchange AFX Trade on July 22, emptying nearly the entire balance locked in the protocol. Security firm Blockaid detected the exploit at 21:30 UTC and confirmed the attack was specific to the AFX-operated bridge, not Arbitrum's own infrastructure.
According to onchain analytics account Lookonchain, the attacker moved the stolen funds to Ethereum and converted them into 12,467 ETH at an average price of $1,937 per coin. The exploiter's address was tracked on Arkham. AFX had published no statement on its X account at the time of writing.
Blockaid said it is working with the Arbitrum team to respond to the incident, engage with the affected protocol, and help contain the stolen funds. Steven Goldfeder, co-founder of Arbitrum developer Offchain Labs, confirmed the network's native bridge was not touched. 'We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,' Goldfeder wrote, adding that Offchain Labs would coordinate with the AFX team and provide more details as they became available.
Context and Scale
DefiLlama data showed the AFX bridge contract held about $24.2 million in USDC before the attack, meaning the exploit wiped out virtually all deposited funds. That balance had grown from roughly $19.3 million in mid-June, a period of about five weeks. AFX, short for Anti-Fragile Exchange, describes itself as a sovereign Layer 1 blockchain built for decentralized derivatives, offering USDC-margined perpetuals with up to 100x use on crypto assets, equities, ETFs and commodities. User deposits enter the protocol through the Arbitrum-based bridge contract that was targeted.
The attack is the second significant exploit on an Arbitrum-based protocol in July. On July 15, perpetuals exchange Ostium halted trading after an attacker manipulated its oracle system to drain up to $18 million in USDC from its liquidity vault. That earlier Arbitrum exploit drew attention to the concentration of high-use DeFi activity on the network and the risks in third-party bridge contracts specifically.
Markets absorbed the news with little reaction. ETH was trading at about $1,928, roughly flat over 24 hours, while ARB was down 0.3% at $0.0806, per CoinGecko. ARB had set an all-time low of $0.0705 on June 26.
This article is for informational purposes only and does not constitute financial or investment advice.
