Hassan Maishera
TL;DR
-
AFX Trade lost approximately $24.15 million in USDC in a bridge-related exploit on Arbitrum.
-
Blockchain security firms Blockaid and PeckShield identified the attack and are assisting with the investigation.
-
The attacker bridged the stolen assets to Ethereum and exchanged them for around 12,467 ETH.
Decentralized trading protocol AFX Trade has fallen victim to a major security breach, with attackers stealing approximately $24.15 million in USDC through an exploit involving one of the protocol's bridges on the Arbitrum network.
Blockchain security firm Blockaid disclosed the incident on Wednesday, stating that the attack specifically targeted a bridge operated by AFX Trade rather than Arbitrum's core infrastructure.
Blockaid detected an exploit at 2026-07-22 21:30 UTC targeting @AFX_XYZ, a protocol on @arbitrum. The exploit was specific to a bridge that AFX operates. Approximately 24.15M USDC has been drained thus far from the protocol.
— Blockaid (@blockaid_) July 22, 2026
Our team has been working with the incredible folks on… https://t.co/0Qd9ve5gPB
The exploit marks another significant security incident affecting decentralized finance (DeFi), where bridge vulnerabilities continue to be a favored attack vector for hackers.
Blockaid Identifies Bridge Vulnerability
According to Blockaid, the exploit was isolated to AFX Trade's proprietary bridge. The security firm said it is actively working alongside the Arbitrum team and the affected protocol to investigate the incident, coordinate response efforts, and assess the full impact of the breach.
At the time of the disclosure, additional technical details regarding how the vulnerability was exploited had not been released.
Blockchain security company PeckShield reported that the attacker quickly transferred the stolen assets from Arbitrum to the Ethereum mainnet.
#PeckShieldAlert @AFX_XYZ on #Arbitrum has been exploited for ~$24M USDC. The exploiter has bridged the stolen funds from #Abitrum to #Ethereum and swapped them for 12,467.5 $ETH, currently sitting in 0x6276...ebAC.https://t.co/INZ7ZxtRhE pic.twitter.com/fUHFfEn1F5
— PeckShieldAlert (@PeckShieldAlert) July 23, 2026
After bridging the funds, the attacker swapped the stolen USDC for approximately 12,467 ETH, valued at around $24 million based on current market prices.
Moving stolen assets across blockchain networks and converting them into more liquid cryptocurrencies such as Ether is a common tactic used by attackers to complicate asset tracing and recovery efforts.
Arbitrum Native Bridge Remains Secure
Following reports of the exploit, Steven Goldfeder, CEO of Offchain Labs, the company behind Arbitrum, sought to reassure users that the network's native bridge was not affected.
In a statement shared on X, Goldfeder confirmed that investigators had traced the malicious transaction to a third-party protocol rather than Arbitrum's core infrastructure.
He emphasized that there was no evidence of any compromise involving the Arbitrum native bridge and said the team is continuing to work closely with AFX Trade as the investigation progresses.
We're aware of a report of a bridge hack on Arbitrum and are investigating. We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way.
— Steven Goldfeder (@sgoldfed) July 22, 2026
We will coordinate with the third…
Offchain Labs and Blockaid are continuing to investigate the exploit to determine how the attacker gained access to the bridge and whether additional vulnerabilities exist.
Goldfeder said Arbitrum will share further information once investigators have completed a more detailed analysis of the incident.
Meanwhile, users of AFX Trade are awaiting updates regarding potential recovery efforts and any measures the protocol may implement to strengthen its bridge security.
The latest exploit highlights the persistent security risks facing cross-chain bridges and decentralized finance protocols.
Bridges have repeatedly been targeted by attackers because they often hold significant amounts of locked assets while relying on complex smart contract architectures. Even when the underlying blockchain remains secure, vulnerabilities in third-party bridge implementations can expose protocols to substantial financial losses.
Last month, a security flaw in Secret Network's Axelar bridge integration allowed an attacker to steal approximately $4.67 million in crypto assets. Also in June, Gravity Bridge, a cross-chain protocol connecting Ethereum and the Cosmos ecosystem, suffered a security breach resulting in the loss of approximately $5.4 million in digital assets.
