AFX Commerce, a perpetuals alternate on Arbitrum, was drained of about $24 million in an exploit that hit a USDC bridge the protocol itself operates.
The alternate stated the breach was remoted to that bridge and the precise assault vector remains to be beneath investigation; on-chain trackers say the funds have been swapped for 12,468 ETH.
AFX has halted the bridge and publicly supplied the attacker a deal—return 70% of the funds and hold the remaining as a “white hat bounty.”
AFX Commerce, a decentralized perpetuals alternate on Arbitrum that settles within the stablecoin USDC, was drained of $24.15 million on Wednesday in anexploit that hit a bridge the protocol operates, safety agencyBlockaid stated.
In a tweet, AFX stated the precise assault vector stays beneath investigation. The on-chain cash path reveals that the attacker bridged the stolen USDC to Ethereum and swapped it for 12,468 ETH, now sitting in a single pockets,PeckShield stated.
AFX is conscious of an incident involving the AFX-operated USDC custody bridge on Arbitrum. Upon detecting the incident, we instantly suspended bridge operations and initiated our incident response procedures. Our engineering and safety groups are actively investigating the basis…
— AFX Commerce (@AFX_XYZ) July 23, 2026
Arbitrum moved quick to place distance between itself and the protocol. Co-founder Steven Goldfederstated the community’s native bridge “has not been hacked or exploited in any approach,” and that the transaction got here from a third-party protocol. A breach of Arbitrum’s personal bridge would ripple throughout the whole layer-2; a compromised app sitting on high of it’s a contained failure.
AFX suspended bridge operations and stated the injury appeared“remoted to the AFX-operated custody bridge,” noting that neither its buying and selling infrastructure and mainnet, nor the Arbitrum community itself, had been compromised.
The agency added that it was working with ecosystem companions and safety companies to hint the stolen property. Hours later, AFX’s head of progress, Ken C,supplied the attacker a approach out: return 70% of the haul and hold the opposite 30% as a “white hat bounty.” Such public pleas have turn out to be a recurring characteristic of crypto exploits—Solana’s Drift Protocoltried the identical after its $285 million hack in April.
The theft extends a brutal yr for DeFi, which has misplaced greater than $840 million to hacks in 2026. It lands near house, too, with fellow Arbitrum perpetuals venueOstium drained of $18 million by way of a compromised oracle key only a week earlier.
Each day Debrief Publication
Begin day-after-day with the highest information tales proper now, plus authentic options, a podcast, movies and extra.
