AFX Trade (2026) — Crypto Hack
ConfirmedAn attacker compromised the private keys of five of the seven validators of the bridge AFX Trade operates on Arbitrum (7,142 of 10,000 voting units, above the 6,667 two-thirds quorum) and produced a valid withdrawal of 24,150,000 USDC, nearly the protocol's entire TVL. AFX offered a 30% bounty.
Summary
An attacker compromised the private keys of five of the seven validators of the bridge AFX Trade operates on Arbitrum (7,142 of 10,000 voting units, above the 6,667 two-thirds quorum) and produced a valid withdrawal of 24,150,000 USDC, nearly the protocol's entire TVL. AFX offered a 30% bounty.
How It Was Compromised — Bridge via Compromised Validator Signing Keys / Quorum Bypass
On July 22, 2026, an attacker compromised the private keys of five of the seven validators of the bridge AFX Trade operates on Arbitrum, controlling 7,142 of 10,000 voting units — above the 6,667 two-thirds quorum — and produced a valid withdrawal of 24,150,000 USDC. The contract verified the signatures and released funds after a 200-second dispute window. Blockaid detected the exploit at 21:30 UTC on July 22. The USDC was bridged to Ethereum and swapped for ~12,467 ETH held in a single wallet. Arbitrum's native bridge was not affected. The drain was nearly the protocol's entire TVL. AFX offered a 30% bounty.
Fund Flow & Laundering Analysis
The 24,150,000 USDC was bridged to Ethereum and swapped for ~12,467 ETH held in a single wallet. AFX offered a 30% bounty.