Arbitrum-based AFX Trade drained of $24 million after bridge keys compromised
AFX Trade, a decentralized perpetuals exchange on Arbitrum, was drained of $24.15 million after an attacker compromised validator signing keys for a bridge the protocol operates. The attacker moved the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH.
Intelligence analysis by Llama
AFX Trade was drained of $24.15 million after an attacker compromised validator signing keys for a bridge the protocol operates. The attacker moved the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH.
Imagine you have a special key that lets you take money out of a bank. If someone gets that key and uses it to take all the money out, that's basically what happened to AFX Trade. The attacker got the key and took $24 million out of the bank, which is a lot of money.
Analysis
A $60B Vote of Confidence
AFX Trade, a decentralized perpetuals exchange on Arbitrum, was drained of $24.15 million after an attacker compromised validator signing keys for a bridge the protocol operates. This incident is similar to the roughly $285 million Drift Protocol loss in April, where attackers spent months working their way to privileged access rather than breaking any contract.
The loss lands amid a punishing stretch for crypto security, with Q2 among the worst quarters for hacks on record and a run of Arbitrum-based protocols, including the oracle exploit that drained a separate $18 million from RWA platform Ostium a week earlier, hit in quick succession. Most of the hacks and exploits this year have targeted offchain components rather than vulnerabilities in smart contracts themselves.
Why Cursor?
The contract treated the withdrawal as valid and released the funds after a 200-second dispute period. The bridge did exactly what it was designed to do, but the keys authorizing the withdrawal were apparently in the wrong hands. The attacker then bridged the stolen USDC to Ethereum and swapped it for about 12,467 ETH, worth roughly $24 million, which on-chain trackers say now sits in a single wallet.
The Road Ahead
AFX's trading activity had been climbing sharply in the run-up to the attack, with daily perpetuals volume spiking to multi-month highs in mid-July, according to DefiLlama, as the protocol drew in users and, with them, deposits. The roughly $24 million drained was almost the entirety of the protocol's total value locked, meaning the attacker emptied the vault at close to the moment it was fullest.
Key points
- AFX Trade was drained of $24.15 million after an attacker compromised validator signing keys for a bridge the protocol operates.
- The attacker moved the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH.
- The loss lands amid a punishing stretch for crypto security, with Q2 among the worst quarters for hacks on record.
- Most of the hacks and exploits this year have targeted offchain components rather than vulnerabilities in smart contracts themselves.
The incident highlights the importance of securing off-chain components in DeFi protocols, and it may lead to increased security measures being implemented to prevent similar attacks in the future.
The hack may have a negative impact on the reputation of Arbitrum-based protocols and may lead to a decrease in user trust and confidence in these platforms.
