A cross-chain bridge associated with AFX was attacked on July 22, resulting in the outflow of approximately $24.15 million USDC. Public information indicates that the affected facility was a third-party bridging infrastructure operated by AFX itself, not the native Arbitrum bridge. Following the incident, Blockaid, the Arbitrum team, and on-chain tracking agencies began monitoring the flow of funds.
The stolen funds flowed to Ethereum.
Blockaid stated that the attack occurred around 21:30 on July 22. Arbiscan records show that the bridge contract completed a transfer of 24.15 million USDC at 21:30:25, with the funds being sent to an address controlled by the attacker.
Subsequently, PeckShield and Lookonchain tracked the transaction and found that the USDC had been transferred from Arbitrum to Ethereum and exchanged for approximately 12,467.5 ETH. Lookonchain stated that the average purchase price was approximately $1,937 per ETH.
Arbitrum native bridges are unaffected.
Steven Goldfeder, co-founder of Offchain Labs, stated that the unusual transactions originated from a third-party protocol, and the Arbitrum native bridge was not attacked or exploited.
AFX's trading system runs on its dedicated Layer 1, but accepts USDC deposits from users via Arbitrum. The issue stems from the bridging infrastructure used by AFX, not the Arbitrum core bridging system. The public response clearly distinguishes between the two.
The investigation focuses on the authorization process.
The investigation is currently focused on the bridging facility operated by AFX and how the attackers gained authorization to withdraw $24.15 million in USDC. Existing on-chain records only confirm that the bridge contract completed the transfer, which is insufficient to explain the underlying cause.
As of press time, AFX has not released a verified technical review, nor has it announced a clear recovery or compensation plan. External security teams are still tracking the whereabouts of the relevant ETH.
Additional information:In April of this year, Kelp DAO's LayerZero-based bridging system also suffered a major attack, with approximately 116,500 rsETH being transferred away. Subsequently, Arbitrum froze over 30,000 ETH related to the case.
