Breaches and incidentsBriefChecked against a primary source
AFX Trade: developer lured into running a malicious project, bridge validator signing taken over
22 Jul 2026, Arbitrum: about USD 24.15M USDC drained from AFX’s own custody bridge, moved to Ethereum and swapped to about 12,467 ETH.
- Disclosed
What happened
- Root cause per AFX’s post-mortem as summarized by BlockSec: a developer was tricked via Telegram into downloading a project containing malicious code. The attack began 9 Jul, compromised the development environment, reached internal systems, and obtained signing authority over the bridge validators. Five validator signatures (7,142 of 10,000 voting power) passed the two-thirds threshold, so the contract worked as designed.
- Attribution: none.
- Response: bridge suspended. AFX offered a USD 7.2M bounty (30%) for return of 70%. Arbitrum’s native bridge was not affected.
Sources
- https://blocksec.com/blog/defi-security-incidents-afx-trade-ostium
- https://cryptobriefing.com/afx-trade-24m-exploit-hacker-bounty/
- https://www.halborn.com/blog/post/explained-the-afxbridge-hack-july-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.