AFX Trade loses $24M in bridge breach, dangles 30% bounty for hacker
Security & Exploits ·
The Arbitrum-based perpetuals exchange says the custody bridge it runs, not the underlying Arbitrum network, was the point of failure.
AFX Trade, a decentralized perpetuals exchange operating on Arbitrum and settling trades in USDC, had roughly $24 million siphoned from its systems on Wednesday, according to Decrypt. The exchange has since paused bridge operations while it investigates, and has publicly asked the attacker to send back 70% of the haul in exchange for keeping the remaining 30% as a so-called white hat bounty.
The intrusion targeted a USDC bridge that AFX itself operates, rather than Arbitrum's core infrastructure. Reporting from Coindesk indicates the breach stemmed from compromised bridge validator keys, which allowed the attacker to push through withdrawals without proper authorization. AFX has characterized the damage as confined to that bridge component, stating its trading engine, mainnet operations, and the Arbitrum chain itself remain unaffected.
Once the funds were extracted, they were moved across to Ethereum and converted into 12,468 ETH, which is now sitting in one wallet, per on-chain analysis. Arbitrum's team moved to distance the network from the incident, with a co-founder noting publicly that the chain's own native bridge was untouched and that the exploited component belonged to a third party building on top of it — framing the event as a contained application-level failure rather than an infrastructure-wide one.
Offering attackers a cut of stolen funds in return for giving back the rest has become a familiar pattern following major DeFi exploits, echoing an approach Solana's Drift Protocol took after losing $285 million in April. Whether AFX's attacker will accept the terms remains unknown.
The incident adds to a difficult stretch for decentralized finance, which has already absorbed more than $840 million in hacks so far in 2026. It also follows closely on the heels of another Arbitrum perpetuals platform, Ostium, which lost $18 million after an oracle key was compromised just a week before the AFX breach.
What triggered the validator key compromise, whether the attacker will engage with AFX's bounty offer, and whether any funds can be recovered all remain open questions as the investigation continues.