AFX Trade loses 24.15 million USDC after developer social engineering attack on its Arbitrum bridge
AFX Trade, an Arbitrum perpetuals exchange, lost 24.15M USDC on 22 July after attackers compromised bridge signing keys via its development environment. No recovery reported. AFX launched a goodwill programme for users. Use only AFX's official channels.
If you held funds on AFX Trade, use only AFX's official app and announcements to check the goodwill programme, and ignore anyone who messages you offering recovery. Anyone who gets a recruiter's job offer asking them to run code should be cautious.
What’s happening
AFX Trade, a decentralised perpetuals exchange built on Arbitrum, lost about 24.15 million USDC on 22 July 2026 when attackers used compromised hot validator signing keys to approve a withdrawal from a custody bridge that AFX operates. The amount was nearly all of AFX's value locked. The attacker moved the funds to Ethereum and swapped them for roughly 12,467 ETH, which on-chain trackers say sat in one wallet. Arbitrum's own bridge was not breached. AFX said the attack began in its development environment and spread to build and validator systems through a social engineering approach; its post-mortem reportedly describes a fake recruitment approach and a malicious code repository, though we could not open that post. AFX suspended the bridge and offered the attacker a 30% bounty to return 70%. No return or recovery has been reported. AFX later announced a goodwill support programme for affected users, but we could not read its terms. No arrests or charges have been reported. A secondary report attributing the attack to a North Korea-linked group is unconfirmed.
- What
- Breach
- Affects
- AFX Trade (Arbitrum-based perpetuals exchange) USDC custody bridge
- Fixed in
- Nothing to patch
- Since
- 9 July 2026
- Closed
- 3 Aug 2026
Timeline
- UpdateNothing to patch
After saying on 31 July that its technical investigation was complete, AFX scheduled and, according to its own posts as reported in search results, published a User Goodwill Support Program for affected users. We could not read the programme's terms.
- UpdateNothing to patch
AFX said its initial investigation found a coordinated social engineering and infrastructure compromise. Attackers entered through the development environment, then escalated to internal build infrastructure and validator systems. AFX said it was verifying balances, working to recover funds and preparing a remediation plan.
- UpdateNothing to patch
AFX suspended the USDC custody bridge and said the breach was isolated to that bridge, not its trading systems or the Arbitrum network. Its head of growth publicly offered the attacker a deal to return 70% of the funds and keep 30% as a bounty; no response from the attacker was reported.
- Made publicNothing to patch
Blockaid detected the exploit of AFX Trade's custody bridge on Arbitrum. Five hot validator signatures met the bridge's roughly two-thirds quorum and approved a withdrawal of 24,150,000 USDC, which the attacker bridged to Ethereum and swapped for about 12,467 ETH.
Sources
- Arbitrum-based AFX Trade drained of $24 million after bridge keys compromisedCoinDesk · 23 July 2026
- Arbitrum perp DEX AFX Trade drained of $24M, offers hacker 30% to return itDecrypt · 23 July 2026
- AFX Trade Confirms Social Engineering and Infrastructure AttackKuCoin News · 25 July 2026
- AFX schedules Aug. 3 goodwill plan following $24.15M bridge hackCryptonews · 31 July 2026
- A detailed post-mortem on the AFX security incidentAFX Trade · 31 July 2026