The hacker behind the recent AFX Trader exploit has moved part of the stolen assets through THORChain, a decentralized cross-chain liquidity protocol. On July 23, the attacker swapped 655.4 ETH for approximately 18.86 BTC, according to blockchain analyst EmberCN.

AFX Trader Exploit Timeline

The incident began on July 23, when AFX Trader, an Arbitrum-based decentralized finance protocol, lost $24.15 million in USDC in a bridge hack. After the breach, the attacker converted the stolen USDC into 12,467.4 ETH, a tactic often used to complicate fund tracing and reduce exposure to stablecoin blacklisting.

The later use of THORChain allowed the attacker to conduct a native cross-chain swap. THORChain enables users to exchange assets across different blockchains without wrapping tokens or relying on centralized intermediaries. In cases involving stolen funds, that structure can make tracing and freezing assets more difficult for investigators, law enforcement, and blockchain analytics firms, even when movements remain visible on public blockchains.

White-Hat Negotiation Offer

Following the breach, AFX Trader proposed a white-hat negotiation to the attacker. Under the offer, the hacker would be permitted to legally keep 30% of the stolen funds, or approximately $7.24 million, in exchange for returning the remaining 70% of the assets to the protocol.

Such negotiations have occurred in other DeFi incidents, where affected protocols sometimes offer a bounty or a share of stolen funds to encourage attackers to return most of the assets and avoid further legal escalation. The practice remains controversial, but it has become one of the recovery approaches used after some decentralized finance exploits.

Cross-Chain Bridge Risks

The AFX Trader incident points to continuing security vulnerabilities affecting cross-chain bridges, which have repeatedly been targeted in crypto-related attacks. Bridges are used to move assets between blockchains, but their liquidity pools and smart-contract systems can create attractive targets when weaknesses are found.

The movement of funds through THORChain also underscores the challenges involved in tracking assets across multiple blockchains without centralized control points. Unlike transactions routed through centralized exchanges, native cross-chain swaps can reduce the number of intermediaries that may be able to block or freeze assets.

For DeFi users, the case illustrates the operational and security risks that can be associated with protocols, bridge infrastructure, and liquidity systems, particularly where security audits and risk controls are central to user trust. For investigators and affected protocols, the key practical issue is whether stolen assets remain traceable and recoverable after being converted across chains and into assets that are harder to freeze than centralized stablecoins.

Current Status

The AFX Trader hacker’s use of THORChain to swap 655.4 ETH into approximately 18.86 BTC adds complexity to the recovery effort following the $24.15 million bridge exploit. AFX Trader’s white-hat negotiation offer remains open, and the attacker has not publicly responded.

The wider DeFi ecosystem continues to face the challenge of balancing decentralization with security, as bridge exploits remain among the costliest attack vectors in the cryptocurrency sector. In this case, the next observable developments would be any public response to AFX Trader’s offer, further on-chain movement of the remaining ETH, or any return of funds to the protocol.

Additional Details

THORChain is a decentralized cross-chain liquidity protocol that supports swaps of native assets across blockchains without wrapped tokens or centralized exchanges. In this case, the hacker used it to convert ETH into BTC in a way that may be harder to trace or freeze.

AFX Trader lost $24.15 million in USDC from its Arbitrum bridge. The attacker subsequently converted the stolen funds into 12,467.4 ETH, and a portion of those assets has since been swapped for Bitcoin.

A white-hat negotiation in crypto is an offer from a protocol to an attacker, usually allowing the attacker to keep a percentage of the stolen funds in exchange for returning the rest. These arrangements are often pursued to recover assets without further escalation, though they remain disputed within the industry.