Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingAFX Trade was attacked and approximately US$24 million in USDC was stolen.
It was reported that approximately US$24 million in USDC was transferred from the Arbitrum based AFX Trade platform due to the theft of the key that controlled its cross-chain bridge. This security incident is an operational error, not a clear vulnerability in the chain code itself.
Summary of the incident
What happened: AFX Trade's cross-chain bridge on Arbitrum was attacked and USDC was reported to have lost approximately US$24 million.
Reason: The loss stems from the theft of the cross-chain bridge key, not the vulnerability of the smart contract logic.
Significance of the event: Key theft is a failure at the operational security level that may bypass the originally complete protocol code.
Attack details
Attackers reportedly stole approximately $24 million in USDC from the AFX cross-chain bridge on Arbitrum. According to available information, the cause of this incident was determined to be the theft of the cross-chain bridge key, rather than the flaw in the code on the platform chain. This distinction is crucial: key theft means that an attacker obtains credentials to authorize cross-chain operations, rather than exploiting vulnerabilities written in smart contracts.
Security company Blockaid publicly flagged the incident on the X platform, attracting attention in time when the attack occurred.
How key theft leads to millions of dollars in losses
Cross-chain bridge keys typically control privileged operations involving cross-chain custody, such as authorizing the release or transfer of cross-chain assets. When these keys have such rights, the person holding the key can control the flow of funds.
The path from key acquisition to fund loss
If an attacker obtains the key, they may be able to sign transactions to transfer or release cross-chain assets without exploiting any code vulnerabilities. In the AFX incident, based on early reports, the attack was attributed to such key access rather than a contract vulnerability. As the investigation deepens, early details of the incident may change, and it is not yet clear how the attacker obtained the key. This is an operational security risk that still exists even if no flaws in the core protocol code are found.
Impact on Arbitrum user and cross-chain bridge security
Events involving privileged key access often raise questions about escrow design, signer distribution, and emergency control measures. For AFX users, what they are most concerned about at present is their own risk exposure and the safety of remaining funds after the cross-chain bridge is breached.
Things to Pay Attention to
Users typically expect the affected team to make clear statements about the security of funds, whether stolen keys have been rotated or revoked, and any compensation plans. Clear communication in these areas is the next practical step.
In addition, cross-chain bridge security incidents have once again triggered a review of multi-signature control, monitoring and key management practices in the DeFi field. Discussions on how such agreements should be governed and controlled have extended to the regulatory level, with officials assessing when securities laws might apply to DeFi coffers and on-chain lending, highlighting the growing concern about the security and regulation of these systems.
