A bridge operated by decentralized derivatives platform AFX Trade lost 24.15 million USDC on Wednesday after an unauthorized withdrawal cleared its validator approval and dispute process.
Blockaid detected the exploit at approximately 21:30 UTC on July 22. The security firm said the affected infrastructure was operated by AFX and that it was working with Arbitrum contributors to contact the protocol and contain the stolen funds.
The bridge held approximately $24.2 million in USDC before the transaction, leaving little remaining stablecoin liquidity after the withdrawal.
Preliminary onchain analysis found that signatures associated with five hot validators authorized the 24,150,000 USDC transfer. The signatures represented 7,142 of the bridge’s 10,000 validator-power units, clearing the two-thirds threshold required to approve a withdrawal.
The request then passed through a roughly 200-second dispute window before the bridge contract released the funds. AFX had not published a technical postmortem confirming whether validator keys were stolen, signers were compromised or another authorization weakness allowed the transaction.
Attacker Converts USDC Into 12,467 ETH
The attacker moved the USDC from Arbitrum to Ethereum through Circle’s Cross-Chain Transfer Protocol before exchanging it for approximately 12,467 ETH.
Lookonchain placed the average purchase price near $1,937 per ETH. The converted assets were worth roughly $24.15 million when the swaps were completed.
Offchain Labs CEO Steven Goldfeder said the transaction originated from a third-party protocol and that Arbitrum’s native bridge had not been hacked or exploited. The Arbitrum team began coordinating with the affected project while investigating the withdrawal.
AFX had not disclosed a recovery agreement, compensation process or final explanation for the validator approvals at publication.
Bridge Exploits Add To Week’s DeFi Losses
The AFX withdrawal followed several attacks reported during the same week. Balance Coin collapsed after a $915,000 oracle exploit at 42DAO on July 22, when a manipulated BTCB price triggered liquidations and undercollateralized BLC issuance.
Wanchain disabled its Cardano-BNB Chain bridge after 515 million NIGHT left its treasury through transactions tied to a suspected signature-reuse flaw.
Be the first to comment