What happened
On July 22, 2026, an attacker used five compromised AFX hot-validator signatures to drain roughly $24.15 million from the AFX-operated Arbitrum bridge; the event was publicly disclosed on July 23.
How it happened
The five signatures met the bridge’s two-thirds quorum, so the on-chain signature check executed as designed. The resulting funds moved to Ethereum and were swapped for about 12,467 ETH. AFX suspended bridge operations and offered a return bounty; no confirmed recovery was found in the reviewed sources.
Protocol details
Security review history
- Zellic View report
Evidence
- report AFX public incident update x.com
- report @CertiKAlert incident report x.com
- report @PeckShieldAlert incident report x.com
- report Post-mortem rekt.news
- report AFX Bridge Incident: What Happened, What We Learned, and What Comes Next medium.com
- analysis DeFiLlama defillama.com
- analysis CoinDesk: AFX Trade bridge incident coindesk.com
- analysis The Block: AFX Trade incident theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
