A cross-chain bridge operated by decentralized derivatives platform AFX has lost approximately $24.15 million in USDC, adding to a growing series of attacks targeting the infrastructure used to move assets between blockchain networks.
Blockchain security firm Blockaid detected the exploit at approximately 9:30 p.m. UTC on July 22. On-chain records showed 24.15 million USDC leaving the affected bridge contract in a single transaction and moving to an address controlled by the attacker.
The incident affected a third-party bridge operated by AFX, rather than Arbitrum’s native bridge. Offchain Labs co-founder Steven Goldfeder said the suspicious transaction originated from an external protocol and confirmed that Arbitrum’s core bridging infrastructure had not been compromised.
AFX is a decentralized perpetual futures platform that operates through a sovereign execution environment while allowing users to deposit USDC through Arbitrum. The affected bridge formed part of that deposit infrastructure, creating a route between user funds on Arbitrum and the trading platform.
At the time of reporting, AFX had not published a complete technical postmortem or confirmed whether users would be reimbursed.
Attacker Converts Stolen USDC Into Ether
After withdrawing the USDC, the attacker transferred the funds from Arbitrum to Ethereum and swapped them for approximately 12,467.5 ETH, according to on-chain security researchers.
The conversion was completed at an estimated average price of around $1,937 per Ether. Moving from USDC into ETH reduced the possibility that the stolen value could be frozen directly by Circle, the issuer of the dollar-backed stablecoin, while also exposing the attacker’s holdings to Ether price volatility.
Security firms continued tracking the destination wallet, but no recovery or asset seizure had been confirmed. Blockaid said it was coordinating with the Arbitrum team to contact AFX, contain the incident and trace the stolen funds.
The verified transaction shows that the bridge contract authorized the withdrawal, but the precise cause remains under investigation. Potential explanations could include compromised administrative credentials, validator-key exposure, faulty access controls or a smart-contract vulnerability. None had been conclusively established.
The distinction between the AFX-operated bridge and Arbitrum’s native bridge is important because initial reports describing an “Arbitrum bridge hack” risked implying a wider network-level failure. Arbitrum continued operating normally, and no losses were reported from its official bridge.
Bridge Security Remains a Structural DeFi Risk
Cross-chain bridges remain attractive targets because they frequently hold large pools of assets while relying on validators, multisignature wallets or messaging systems to authorize transfers between otherwise separate blockchains.
A single weakness can allow an attacker to release assets without depositing equivalent collateral on the originating network. The complexity of coordinating contracts, signers and external infrastructure also creates more attack surfaces than a conventional single-chain application.
The AFX incident occurred only hours before security researchers disclosed a separate exploit affecting the Verus Ethereum Bridge, where approximately $7.5 million was reportedly stolen. Together, the incidents produced more than $31 million in bridge-related losses within a short period.
For AFX, the immediate priorities will be identifying the compromised component, securing remaining reserves and explaining whether customer balances are fully backed. Until a postmortem is released, the exploit remains a confirmed $24.15 million loss with an unresolved cause—and another reminder that cross-chain convenience continues to carry substantial security risk.
