AFX Trade bridge hack steals $24.15M USDC on Arbitrum

A decentralized trading protocol on the Arbitrum network was drained of approximately $24.15 million on July 22 after an attacker compromised the validator keys for a cross-chain bridge it operates. The incident targeted AFX Trade, a platform for perpetual futures contracts, but did not involve a breach of Arbitrum's core infrastructure.

Security firm Blockaid detected the exploit at 9:30 p.m. UTC on Wednesday. The firm stated the attack was specific to a bridge operated by AFX, which the protocol uses to accept USDC deposits from users on Arbitrum. Blockchain data shows the attacker successfully withdrew 24,150,000 USDC from the bridge contract after obtaining the necessary validator signatures to meet the protocol's quorum. Blockaid noted the on-chain logic functioned as designed, indicating the bridge's security was circumvented through compromised authorization keys rather than a code flaw.

Steven Goldfeder, co-founder of Offchain Labs, the developer behind Arbitrum, confirmed the transaction originated from a third-party protocol and emphasized that Arbitrum's native bridge was not hacked or exploited. This distinction is critical, as a breach of the layer-2 network's core...