Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingAttacker steals 24 million USDC using hot verifier signature
According to the original report, an attacker used hot verifier signature to authorize a large withdrawal from the Arbitration-based AFX Trade platform, stealing 24.15 million USDC. Security agencies traced the attack to a key leak in an external bridge operated by the platform, not a vulnerability in the core infrastructure of the Layer-2 network.
Arbitrum quickly confirms that its native bridge is unaffected. This distinction is important because custom bridges built by teams-used to connect Ethereum applications to the L2 network-typically rely on a smaller set of verifiers, which makes it easier for key compromise attacks to succeed. In this incident, the attacker collected enough valid signatures to bypass standard security thresholds and move funds off the platform.
Verifier signature vulnerability
External bridges often rely on multi-signature or authoritative attestation systems, in which a certain number of keys can approve transfers. Security researchers point out that AFX Trade's attack vector points to poor key management practices rather than flaws in smart contracts. The stolen funds are USDC and withdrawals are made through a single transaction, which observers say normally requires multiple independent approvals.
The incident highlights a pattern that has plagued cross-chain infrastructure for years. Bridging remains the weakest link between networks. From Wormhole to Ronin, a series of attacks always involve the disclosure of governance or verifier keys. What is unique about this case is that it is completely isolated from Arbitrum's own security model, which may protect the entire ecosystem from direct impact.
Although Arbitrum has become one of the top blockchains thanks to its developer activity, the proliferation of third-party bridges built based on its extended framework still brings risks that cannot be completely avoided by the core protocol.
Unclear Details
There are few details about how the key was initially leaked. It is unclear whether the attack originated from phishing activities, insider threats or infrastructure intrusions. On-line investigators are tracking the flow of USDC, but no centralized issuer or law enforcement agency has announced a freeze on funds that may have been transferred through currency mixers or other layers of confusion.
The lack of instant recovery possibilities is likely to worry users who store liquidity on relatively niche bridges. For traders and liquidity providers in the Arbitrum DeFi ecosystem, this incident once again introduces a familiar contradiction: the speed and composability advantages of new bridges often come at the expense of weakening security assumptions.
Widespread impact on the Layer-2 security narrative
AFX Trade's losses come at a time when organizations are paying increasing attention to Ethereum's expansion solutions, and security guarantees are becoming a major selling point. Arbitrum quickly distanced itself from the attack-emphasizing the integrity of its native bridging-suggesting that well-known L2 teams are well aware of the reputational damage that bridging attacks can cause, even if they are not technically at fault.
Still, for affected users, the actual result is no different from any bridging theft: the token is lost and the recovery route is unclear. This incident does not mean that Arbitrum is a systemic risk as a network, but it strengthens the need for DeFi participants to exercise caution when evaluating hosting chains based on mainstream Rollup applications.
The next stage of the story will depend on forensic reports and whether the attacker will leave traces linking wallet activity to known entities. Currently, events in which hot verifier signatures are utilized provide another data point in the ongoing struggle to secure the cross-chain message layer without introducing centralization.
