AFX Trade bridge on Arbitrum drained of $24.15 million in USDC
Security & Exploits ·
Attackers compromised validator keys on the AFX XYZ bridge and approved unauthorized withdrawals, moving stolen funds off Arbitrum before converting them to ETH.
Blockaid identified the exploit targeting the AFX XYZ Bridge on Arbitrum, putting the loss at approximately $24.15 million in USDC, according to a post from Blockaid. Reporting from CoinDesk puts the AFX Trade loss at $24 million, describing the root cause as compromised bridge validator keys that let attackers push through withdrawals without proper authorization.
The mechanics point to a breakdown in the bridge's validation layer rather than a smart-contract logic bug. Once validator keys were compromised, the attacker was able to approve outbound transfers as if they were legitimate, draining USDC held by the bridge. Separate reporting notes the attacker then moved the stolen funds across to Ethereum and converted them into ETH, a step that complicates tracing and recovery efforts.
The Block confirms the AFX Trade protocol on Arbitrum suffered the bridge exploit, aligning with the loss figures reported elsewhere. The incident has drawn attention to Arbitrum's ecosystem specifically, with the network reported to be investigating the bridge hack. The episode adds to a pattern in which cross-chain bridges, which by design hold or mint assets based on off-chain validation, remain among the most frequently targeted components in crypto infrastructure.
What remains unresolved includes whether any funds can be frozen or recovered following the conversion to ETH, and how the validator keys were initially compromised. Also unclear is whether AFX Trade or Arbitrum will publish a post-mortem detailing the key-management failure, and whether other bridges using similar validator-based architectures face comparable exposure.