The Cryptocurrency Post The CryptocurrencyPost
AboutContact
Security

AFX Trade’s Arbitrum Bridge Drained of ~$24.15M in USDC After Validator Key Compromise

Fortified validator node beside a cross-chain bridge with blue neon glow, USDC and ETH icons, illustrating a $24M exploit.

A decentralized perpetuals exchange operating on Arbitrum lost approximately $24.15 million in USDC after security gaps in a cross-chain bridge it operates were exploited. The incident, first flagged at 21:30 UTC on July 22, 2026, targeted AFX Trade’s custom bridge infrastructure rather than the underlying settlement layer.

According to an Arbiscan transaction record and monitoring data from security firm Blockaid, the breach did not stem from a flaw in the bridge’s smart contract logic. Instead, the attacker obtained enough validator signing keys to meet the withdrawal quorum.

Five hot-validator signatures were used to approve the transfer, indicating that the compromise originated at the off-chain custody layer rather than through a code vulnerability. The contract’s on-chain verification functioned as designed, executing the withdrawal once the required signatures were submitted.

After authorizing the movement, the stolen USDC was routed from Arbitrum to Ethereum. On-chain trackers show the funds were subsequently swapped for approximately 12,467 ETH, which are currently consolidated in a single wallet. The average execution price for the conversion was reported around $1,937.

Analytics dashboards indicated that the bridge contract held roughly $24.2 million in total value locked prior to the event, meaning the exploit drained nearly all assets managed by the contract. Offchain Labs co-founder Steven Goldfeder confirmed that Arbitrum’s native bridge infrastructure remained unaffected, isolating the exposure to AFX Trade’s third-party custody setup.

The incident occurred alongside other high-value security events targeting Arbitrum-based protocols, but available sources have not published an official technical statement from AFX Trade regarding key management procedures or user remediation. The exact vector used to access the validator signing keys remains unverified in public disclosures, and wallet activity does not currently clarify whether the ETH position is being prepared for further routing, liquidation or long-term storage.