A bridge operated by decentralized derivatives platform AFX Trade lost 24.15 million USDC on Wednesday after an unauthorized withdrawal passed its validator approval and dispute process.

Blockaid detected the exploit at approximately 21:30 UTC on July 22. In an X post, the security firm said the affected infrastructure was operated by AFX and that it was working with Arbitrum contributors to contact the protocol and contain the stolen funds: https://x.com/blockaid_/status/2080080240265621680

Before the transaction, the bridge held about $24.2 million in USDC. The withdrawal left little remaining stablecoin liquidity in the bridge.

Preliminary onchain analysis found that signatures linked to five hot validators approved the 24,150,000 USDC transfer. Those signatures accounted for 7,142 of the bridge’s 10,000 validator-power units, exceeding the two-thirds threshold required to authorize a withdrawal.

Validator-based bridges typically rely on a quorum of signers and a challenge period to prevent unauthorized transfers before assets are released. In this case, the request then moved through a dispute window of roughly 200 seconds before the bridge contract released the funds. At publication, AFX had not issued a technical postmortem confirming whether validator keys were stolen, signers were compromised, or another authorization weakness allowed the transaction to proceed.

Attacker Converts USDC Into 12,467 ETH

The attacker transferred the USDC from Arbitrum to Ethereum using Circle’s Cross-Chain Transfer Protocol, then exchanged the funds for approximately 12,467 ETH.

Lookonchain said the average purchase price was near $1,937 per ETH: https://x.com/lookonchain/status/2080092059252486487. The converted assets were worth roughly $24.15 million when the swaps were completed.

Offchain Labs CEO Steven Goldfeder said the transaction came from a third-party protocol and that Arbitrum’s native bridge was not hacked or exploited: https://x.com/sgoldfed/status/2080071210847674709. The distinction matters because Arbitrum’s base bridging infrastructure and independent application-level bridges have separate security models, operators, and risk controls. The Arbitrum team began coordinating with the affected project while investigating the withdrawal.

AFX had not announced a recovery agreement, compensation process, or final explanation for the validator approvals at the time of publication.

Bridge Exploits Add to Week’s DeFi Losses

The AFX withdrawal came after several other attacks reported during the same week, adding to scrutiny of cross-chain systems and the offchain components that many of them use to approve transfers. Balance Coin collapsed after a $915,000 oracle exploit at 42DAO on July 22, when a manipulated BTCB price triggered liquidations and undercollateralized BLC issuance.

Wanchain disabled its Cardano-BNB Chain bridge after 515 million NIGHT left its treasury through transactions tied to a suspected signature-reuse flaw.

Allbridge Core also paused operations after a $1.65 million Solana flash-loan exploit manipulated pricing in its stablecoin pool.