Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH AFX Trader hackers transferred 655.4 ETH to Bitcoin through THORChain. The previous US$24 million cross-chain bridge attack
The hackers who caused the recent AFX Trader attack have transferred some of the stolen funds through the decentralized cross-chain liquidity protocol THORChain. According to blockchain analyst EmberCN, on July 23, the attacker exchanged 655.4 Ethereum pieces for approximately 18.86 bitcoins.
AFX Trader attack incident timeline
The incident began on July 23, when AFX Trader, a decentralized financial protocol based on Arbitrum, lost 24.15 million USDC due to a cross-chain bridge attack. The attacker quickly exchanged the stolen USDC for 12,467.4 Ethereum pieces, a common tactic designed to make tracking difficult and circumvent the stablecoin blacklist mechanism.
By using THORChain, hackers took advantage of the protocol's feature that allows native assets to be exchanged across chains without the need to encapsulate assets or rely on centralized intermediaries. This makes it more difficult for investigators to track and freeze funds.
White-hat negotiation proposal
In response to this intrusion, AFX Trader proposed a white-hat negotiation to the attacker. According to the terms, hackers can legally retain 30% of the stolen funds (approximately US$7.24 million) in exchange for returning the remaining 70% of the assets to the agreement.
Such negotiations are not unprecedented in DeFi, where agreements sometimes provide bounties or a percentage of stolen funds as an incentive to encourage hackers to return most assets, thereby avoiding further legal upgrades.
What it means for DeFi users
The AFX Trader incident highlighted ongoing security vulnerabilities in cross-chain bridges, which remain a primary target for attackers. The use of THORChain for fund transfers further highlights the challenges faced by law enforcement agencies and blockchain analytics companies in tracking stolen assets across multiple chains in the absence of centralized supervision.
For DeFi users and investors, this incident is a reminder to be cautious about agreements that have not undergone rigorous security audits and to always be aware of the risks associated with cross-chain bridge liquidity pools.
Conclusion
AFX Trader hackers continue to transfer stolen funds through THORChain, adding another layer of complexity to the already difficult asset recovery effort. Although the white-hat negotiation proposal remains in effect, the attackers have not yet responded publicly. As cross-chain bridge attacks remain one of the most costly attack vectors in the cryptocurrency space, the entire DeFi ecosystem is still struggling to balance decentralization and security.
FAQ
Q1: What is THORChain and why do hackers use it?
THORChain is a decentralized cross-chain liquidity protocol that allows users to exchange native assets between different blockchains without encapsulating tokens or using a centralized exchange. Hackers use it to exchange Ethereum for Bitcoin, a method that is more difficult to track or freeze.
Q2: How much money was lost in the AFX Trader attack?
Attackers stole 24.15 million USDC from the AFX Trader Cross-Chain Bridge on Arbitrum. The funds were subsequently converted into 12,467.4 Ethereum pieces, some of which have now been converted into Bitcoin.
Q3: What is white hat negotiation in cryptocurrencies?
White-hat negotiations are an offer made by the protocol to hackers, usually allowing hackers to retain a certain percentage of stolen funds in exchange for returning the rest. This approach is designed to recover assets without involving law enforcement, but remains controversial.
