AFX Cross-Chain Bridge was attacked, losing 24.15 million USDC, and the attacker purchased 12,467 ET

AFX Cross-Chain Bridge was attacked and lost 24.15 million USDC

On July 22, AFX lost 24.15 million USDC due to an attacker's attack on the cross-chain bridge associated with its transaction agreement.

Event summary

AFX's cross-chain bridge lost 24.15 million USDC in the attack, while Arbitrum's native bridge was unaffected. The attacker transferred the stolen USDC to Ethereum, which was subsequently exchanged for 12,467.5 ETH. Security companies are tracking the stolen funds, and AFX and Arbitrum teams have launched an investigation.

The attack triggered an investigation by the Blockaid and Arbitrum teams, and chain trackers discovered that stolen funds had flowed to Ethereum. The attack did not affect the native bridge of Arbitrum. AFX runs a separate Layer 1 network for perpetual contract trading, but receives USDC deposits through Arbitrum. The infrastructure affected is a third-party bridge operated by AFX, not the core bridge of Arbitrum.

AFX Bridge lost 24.15 million USDC

Blockaid said it detected the attack at 21:30 UTC on July 22. The company said the attack targeted a bridge operated by AFX and stole approximately 24.15 million USDC units. Arbiscan records show that at 21:30:25 UTC, a transfer of 24.15 million USDC units was successfully transferred from the bridge contract to the receiving address.

The security company said it is working with the Arbitrum team to respond, contacting affected agreements and assisting in freezing stolen funds. Public information as of press time shows that no financial recovery has been confirmed. AFX also did not release a verified technical post-mortem analysis report explaining how attackers obtained authorization to withdraw funds. The agreement has not yet announced a recovery plan.

Offchain Labs co-founder Steven Goldfeder confirmed that the suspicious transactions came from third-party agreements. He also distinguished the AFX incident from Arbitrum's own bridge infrastructure.

Goldfeder said: "We have noticed reports of a bridge attack on Arbitrum and are investigating it. It can be confirmed that the relevant transactions originated from third-party agreements and that the Arbitrum native bridge has not been hacked or exploited in any way." He added that the team will coordinate with third-party agreements and share more details when they become available.

AFX uses Arbitrum as a channel for USDC deposits while running a trading system on its dedicated Layer 1. AFX describes itself as a decentralized derivatives platform built around a sovereign execution environment. Recent agreement announcements also mentioned that users can deposit into USDC from Arbitrum before accessing its sustainable market.

Attacker converts stolen USDC into ETH

PeckShield said that the attacker transferred the stolen USDC from Arbitrum to Ethereum, which was later converted into 12,467.5 ETH. Lookonchain separately reported that after transferring funds, the attackers purchased approximately 12467 ETH units at an average price of approximately $1937.

This exchange converts the stolen value from stablecoins anchored in the U.S. dollar to Ethereum, exposing positions to fluctuations in ETH prices. The security team continues to track funds after redemption. As of press time, the sources reviewed did not confirm that Circle had frozen the USDC before redemption, nor did it confirm that any ETH had been recovered.

The attack is one of many bridge-related security incidents this year. It was previously reported that Stake DAO closed its vsdCRV bridge in May after an unauthorized casting incident on the Arbitrum. The project said it has ensured token support on the Ethereum main network and controlled incidents within affected bridges.

Earlier in April, a larger attack targeted Kelp DAO's LayerZero-based bridge. The attackers stole approximately 116500 rsETH, worth approximately $292 million. Arbitrum then froze more than 30000 ETH associated with the attacker after funds flowed into Arbitrum One.

Survey focuses on infrastructure operated by AFX

Survey currently focuses on the bridge operated by AFX and the authorization process behind the 24.15 million USDC withdrawals. The confirmed transaction shows that the bridge contract has completed the transfer, but the public statement has not determined the root cause. A complete post-mortem analysis may determine whether the incident involved a breach of verifier credentials, access control flaws, or other vulnerabilities.

The main point identified is that the attack affected the infrastructure operated by AFX, not the native bridge of Arbitrum. Both Blockaid and Offchain Labs clearly distinguished this point in their initial responses. The Arbitrum network continues to operate, and reports reviewed show no damage to its native bridges.

This incident also focused attention on AFX's deposit infrastructure. The agreement has always used USDC deposits from Arbitrum as entry point into its trading platform. Any changes in deposits, withdrawals or bridge operations will depend on the response to the agreement and ongoing investigations.

The case is still in progress. The loss has been confirmed at approximately 24.15 million USDC units, and online trackers have traced the stolen value to approximately 12467 ETH units on Ethereum. Further updates are expected as the AFX, Blockaid and Arbitrum teams review the breach and track attacker funds.