On July 22, 2026, AFX Trade's Arbitrum bridge was exploited when the attacker obtained 5 of 7 validator private keys, bypassing the 2/3 multisig threshold and draining $24.15M in USDC. The attacker converted funds to ETH and consolidated them in a single wallet. AFX offered a 30% bounty for fund recovery.

The AFX-operated cross-chain/USDC custody bridge on Arbitrum was exploited. The attacker used compromised validator hot keys to meet the quorum and drain approximately $24.15 million USDC. The funds were bridged to Ethereum and swapped for ETH. Arbitrum’s native bridge was unaffected, and AFX’s core trading infrastructure remained secure. The team suspended bridge operations and is investigating with security partners.