AFX Bridge Exploit Drains $24M in USDC on Arbitrum

An attacker drained approximately $24.15 million in USDC from a bridge operated by AFX, a protocol built on Arbitrum, in the latest security incident targeting cross-chain infrastructure.

The exploit was detected by blockchain security firm Blockaid on July 22 at 21:30 UTC, marking the 14th crypto security incident recorded in July. The month has already surpassed June’s total losses from crypto hacks.

The attack targeted AFX’s bridge infrastructure rather than Arbitrum’s own network, highlighting continued security challenges facing third-party protocols operating across blockchain ecosystems.

AFX Bridge Funds Moved to Ethereum

Following the exploit, the attacker transferred the stolen USDC from Arbitrum to Ethereum and converted the funds into approximately 12,467.5 ETH, according to blockchain security firm PeckShield.

The converted assets were traced to a single wallet address identified by PeckShield. The total amount involved could change as security researchers continue monitoring the movement of the funds.

Blockaid said it coordinated with the Arbitrum team after detecting the exploit.

Offchain Labs co-founder Steven Goldfeder confirmed that Arbitrum’s native infrastructure was not affected, clarifying that the incident involved a third-party protocol.

We can confirm that the transaction in question originated from a third party protocol, and the Arbitrum native bridge has not been hacked or exploited in any way,” Goldfeder said.

Bridge Security Remains a Challenge

The AFX incident adds to a growing list of security breaches targeting cross-chain infrastructure, which has historically been one of the most vulnerable areas in decentralized finance.

Blockchain bridges allow assets to move between different networks, but their complexity and reliance on smart contracts, validators and liquidity mechanisms have made them frequent targets for attackers.

According to data from DeFiLlama, 13 crypto hacks had already been recorded in July before the AFX exploit, resulting in approximately $72.6 million in losses. The latest incident brings the monthly total to 14 security breaches.

As blockchain ecosystems continue expanding interoperability, bridge security remains a key challenge for protocols seeking broader adoption from users and institutions.