AFX Trade, a decentralized finance protocol built on Arbitrum, suffered a major security breach after attackers exploited one of its proprietary bridge contracts, draining approximately $24.15 million in USDC. Blockchain security firm Blockaid detected the exploit and confirmed that the attack targeted a bridge operated by AFX rather than the Arbitrum Layer 2 network itself. The incident ranks among the largest DeFi exploits of the month and once again highlights the security risks associated with cross-chain bridge infrastructure.
Following the exploit, blockchain investigators reported that the attacker bridged the stolen funds from Arbitrum to Ethereum, where they were exchanged for approximately 12,467 ETH worth around $24 million. Steven Goldfeder, CEO of Offchain Labs, quickly clarified that Arbitrum’s native bridge and core protocol were not compromised, emphasizing that the incident originated entirely from a third-party application built on the network.
Attack Targeted AFX’s Proprietary Bridge
According to Blockaid, the exploit was isolated to a bridge developed and operated by AFX.
The attack resulted in:
- Approximately $24.15 million USDC stolen.
- Funds immediately bridged from Arbitrum to Ethereum.
- Assets converted into roughly 12,467 ETH.
- Coordination between Blockaid, Arbitrum, and AFX to investigate the incident.
Security teams continue monitoring the attacker’s wallets to determine whether additional funds can be frozen or recovered.
Arbitrum Says Its Network Was Not Hacked
Soon after the exploit became public, Steven Goldfeder addressed growing concerns within the crypto community.
He stated that:
- The exploit originated from a third-party protocol.
- Arbitrum’s native bridge was not exploited.
- The Layer 2 blockchain itself remains secure.
- Offchain Labs is coordinating with AFX during the investigation.
The clarification helped distinguish the attack from vulnerabilities affecting the underlying blockchain infrastructure.
Bridge Security Remains a Major Weakness
Cross-chain bridges continue to represent one of the most common attack vectors in decentralized finance.
Unlike the underlying blockchain, bridges often involve:
- Complex smart contracts.
- Cross-chain message verification.
- Liquidity management.
- Multiple trust assumptions.
These additional layers create more opportunities for attackers to exploit implementation flaws compared with the core blockchain itself.
July Becomes Another Costly Month for Crypto Hacks
The AFX exploit adds to an already expensive month for the digital asset industry.
According to blockchain security trackers:
- This marks approximately the 14th major crypto security incident in July.
- Total July crypto hack losses have climbed to roughly $97 million.
- The monthly total has already exceeded June’s approximately $75 million in reported losses.
The growing number of exploits continues to reinforce calls for stronger smart contract auditing and more robust bridge security.
On-Chain Investigators Track the Stolen Funds
Blockchain analytics firm PeckShield traced the attacker’s activity shortly after the exploit occurred.
Investigators observed:
- USDC moved off Arbitrum.
- Assets bridged onto Ethereum.
- Funds swapped into 12,467 ETH.
- The ETH consolidated into a single wallet under ongoing surveillance.
Because blockchain transactions are publicly visible, investigators will continue monitoring the funds for any movement through exchanges or mixing services.
Security Firms Respond Quickly
The incident demonstrates the increasingly important role played by blockchain security firms.
Companies such as Blockaid and PeckShield now provide:
- Real-time exploit detection.
- On-chain transaction monitoring.
- Incident response coordination.
- Threat intelligence for protocols and exchanges.
Their rapid alerts often provide developers and ecosystem participants with valuable time to respond before additional losses occur.
