Incident Overview
On July 23, 2026, the cross-chain custody bridge operated by decentralized exchange AFX on Arbitrum was exploited, resulting in the unauthorized withdrawal of 24.15 million USDC.
The incident was carried out via a private key or backend validator infrastructure compromise. The attacker forged an on-chain withdrawal request on Arbitrum that carried valid cryptographic signatures from five bridge validators. Because these signatures satisfied the bridge contract's multi-signature authorization threshold, the contract executed the transaction as legitimate and released 24.15 million USDC from custody.
The attacker immediately bridged the stolen stablecoins from Arbitrum to Ethereum Mainnet and swapped them for approximately 12,467.5 ETH. Following detection, AFX suspended bridge operations to isolate the vulnerability, confirming that the platform's core trading engine, mainnet, and Arbitrum's native bridge remained uncompromised while security teams began tracing the funds.
Arbitrum Creation Transaction: 0x217c45c1…b93f74
Arbitrum Finalize Transaction: 0x50d0b3ec…36547b
Ethereum Attacker Wallet: 0x627654b2…b6ebac
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to AFX, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next AFX
The AFX hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.