AFX Hack
REPORTED LOSS
$24.1M
What happened
On July 22, 2026, an attacker used five compromised AFX hot-validator signatures to drain roughly $24.15 million from the AFX-operated Arbitrum bridge; the event was publicly disclosed on July 23.
Case & protocol details
Classification
Bridge
Protocol Type
Exploit/Access control
Official Website
www.afx.xyz/
Protocol Twitter/X
@AFX_XYZ
How it happened
The five signatures met the bridge’s two-thirds quorum, so the on-chain signature check executed as designed. The resulting funds moved to Ethereum and were swapped for about 12,467 ETH. AFX suspended bridge operations and offered a return bounty; no confirmed recovery was found in the reviewed sources.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- analysis AFX public incident update x.com
- analysis CoinDesk: AFX Trade bridge incident coindesk.com
- analysis The Block: AFX Trade incident theblock.co
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
