AFX Trade Hack: Compromised Bridge Keys Drain $24 Million

Another bridge, another stomach drop. AFX Trade’s Arbitrum bridge was hit on July 22, and the numbers aren’t small: roughly $24 million in USDC gone in minutes. The early read is depressingly familiar — not a protocol bug so much as keys in the wrong hands.

You can think of it like a vault where the combination leaked. On-chain approvals looked valid because the attacker had enough signatures. After a short dispute window, the funds were out.

Let’s walk through what happened, how the money moved, and what this means for anyone still relying on third-party bridges.

Point Details Exploit type Private key compromise of bridge validators; withdrawal approved by sufficient hot-validator signatures and finalized after a ~200-second dispute window Finst. Loss magnitude About $24.15M USDC drained; exploit detected at 21:30 UTC on July 22 by Blockaid The Block. Funds flow Attacker bridged to Ethereum and swapped to ~12,467.5 ETH, linked to wallet 0x6276…ebAC, per on-chain trackers and PeckShield Cryptowisser. Bridge TVL context AFX bridge held about $24.18M on Arbitrum just before the incident; exploit classified as “Private Key Compromised” DefiLlama. Immediate response AFX suspended bridge operations and floated a white-hat deal: 70% returned, 30% kept by exploiter if funds are recovered The Block. Detection Blockaid flagged the bridge exploit on July 22 at 21:30 UTC The Block.

… Continue reading the full article at the original source below.