AFX Trade protocol on Arbitrum suffers $24 million bridge exploit
The theft of $24.15 million from the AFX Trade protocol highlights the persistent vulnerability of third-party bridges in Layer 2 networks, even as the underlying Arbitrum infrastructure remains secure.
AFX Trade, a protocol built on the Arbitrum Layer 2 network, lost approximately $24.15 million in USDC following a security breach. Blockchain security firm Blockaid identified the incident on Wednesday, confirming that the vulnerability was isolated to a bridge operated directly by the AFX protocol.
Following the initial drain, the attacker moved the illicit assets across the blockchain. PeckShield reported that the stolen funds were bridged from Arbitrum to the Ethereum mainnet, where they were subsequently converted into 12,467 ETH. At current market valuations, this ether holding is valued at roughly $24 million.
The rapid conversion of the stolen stablecoins into ether indicates an attempt to obscure the trail or capitalize on market liquidity. Such swift asset swaps are typical in decentralized finance exploits, as attackers seek to move funds through automated market makers before security firms can flag the addresses. This maneuver highlights the ongoing challenge that security researchers face when trying to freeze or recover assets once they cross between different blockchain environments.
For investors and market participants, the incident underscores the persistent risks associated with decentralized finance infrastructure and cross-chain asset movement. While the exploit resulted in a substantial financial loss, it also provided a critical test of network isolation. The breach demonstrates how vulnerabilities in peripheral third-party applications can trigger major capital outflows without necessarily compromising the base layer security of the host network.
Arbitrum’s leadership moved quickly to clarify the scope of the breach and protect market confidence in its core infrastructure. Steven Goldfeder, chief executive of Offchain Labs, the developer behind the Arbitrum network, addressed the situation on the social platform X.
"We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way," Goldfeder stated. He noted that the team will coordinate with the third-party developers and report more details as they become available.
Blockaid is currently collaborating with both the Arbitrum team and AFX Trade to manage the immediate fallout from the security incident. The clear distinction between the compromised third-party bridge and Arbitrum’s native infrastructure is a vital detail for institutional investors evaluating the overall safety of Layer 2 ecosystems. As the situation continues to develop, market observers will be watching closely to see if the protocol can recover any of the drained assets or if broader security scrutiny will follow.
