Incident overview
AFX said the affected component was its operated custodial bridge, not the official Arbitrum bridge. CertiK reported that the malicious withdrawal carried five validator signatures representing approximately 7,142 of 10,000 voting weight, above the two-thirds threshold. The strongest current evidence points to compromised validator-signing authority or backend hot keys, while AFX continues to investigate the precise intrusion vector.
Incident sequence
- The attacker submitted a withdrawal proposal with sufficient validator weight to the bridge contract on Arbitrum.
- Minutes later, the withdrawal was executed and approximately 24.15 million USDC left bridge reserves.
- The assets were bridged to Ethereum, swapped into approximately 12,467.44 ETH, and consolidated at one address.
- AFX paused the custodial bridge and said its trading infrastructure, mainnet, and Arbitrum itself were not affected.
- AFX offered a white-hat arrangement under which 70% would be returned and 30% could be retained as a bounty; no completed return had been confirmed by the report cutoff.
Fund flow
Arbitrum bridge contract → cross-chain withdrawal → Ethereum swap/output → 0x627654…ebac. By 18:57 Beijing time, no confirmed large outbound movement of the principal was visible from the main consolidation address.
Amount basis
Approximately 24.15 million USDC was withdrawn. Monitoring estimates of $24.0 million to $24.15 million are rounding variants of the same event, not separate losses. The attacker received approximately 12,467.44 ETH after conversion.
Evidence boundary
The five validator signatures and threshold weight are verifiable, but public evidence does not establish whether the signing authority was compromised through an endpoint, backend service, cloud key, or human disclosure. The official Arbitrum bridge, AFX mainnet, and all AFX products must not be described as compromised.
Current status
The custodial bridge is paused. No public evidence confirms that the full value was frozen, recovered, or returned. The proposed 30% bounty is an offer, not a completed payment.