← Back to Delta Incident Archive

VERIFIED SECURITY INCIDENT · DCI-2026-050

AFX Trade custodial bridge exploited for approximately 24.15 million USDC

AFX confirmed an attack on its operated custodial bridge. Approximately 24.15 million USDC was withdrawn, converted into about 12,467.44 ETH, and consolidated on Ethereum; the exact validator-key compromise path remains under investigation.

Incident date2026-07-23 Attack typeBridge exploit SeverityCritical Involved chainsArbitrum / Ethereum

Incident overview

AFX said the affected component was its operated custodial bridge, not the official Arbitrum bridge. CertiK reported that the malicious withdrawal carried five validator signatures representing approximately 7,142 of 10,000 voting weight, above the two-thirds threshold. The strongest current evidence points to compromised validator-signing authority or backend hot keys, while AFX continues to investigate the precise intrusion vector.

Incident sequence

  1. The attacker submitted a withdrawal proposal with sufficient validator weight to the bridge contract on Arbitrum.
  2. Minutes later, the withdrawal was executed and approximately 24.15 million USDC left bridge reserves.
  3. The assets were bridged to Ethereum, swapped into approximately 12,467.44 ETH, and consolidated at one address.
  4. AFX paused the custodial bridge and said its trading infrastructure, mainnet, and Arbitrum itself were not affected.
  5. AFX offered a white-hat arrangement under which 70% would be returned and 30% could be retained as a bounty; no completed return had been confirmed by the report cutoff.

Fund flow

Arbitrum bridge contract → cross-chain withdrawal → Ethereum swap/output → 0x627654…ebac. By 18:57 Beijing time, no confirmed large outbound movement of the principal was visible from the main consolidation address.

Amount basis

Approximately 24.15 million USDC was withdrawn. Monitoring estimates of $24.0 million to $24.15 million are rounding variants of the same event, not separate losses. The attacker received approximately 12,467.44 ETH after conversion.

Evidence boundary

The five validator signatures and threshold weight are verifiable, but public evidence does not establish whether the signing authority was compromised through an endpoint, backend service, cloud key, or human disclosure. The official Arbitrum bridge, AFX mainnet, and all AFX products must not be described as compromised.

Current status

The custodial bridge is paused. No public evidence confirms that the full value was frozen, recovered, or returned. The proposed 30% bounty is an offer, not a completed payment.