AFX Trade Bridge Exploit Drains $24.15M USDC on Arbitrum

On July 22, 2026, at 21:30 UTC, approximately $24.15 million in USDC was drained from AFX Trade's USDC custody bridge on Arbitrum, as detected by Blockaid. The exploit targeted AFX-operated bridge infrastructure, not Arbitrum's native bridge, and AFX immediately suspended bridge operations and activated incident response. The attacker transferred the stolen USDC from Arbitrum to Ethereum, swapping it into about 12,467.5 ETH, traced to wallet 0x6276…ebAC. Security firms PeckShield and SlowMist are monitoring the funds, and the address has been reported to the Crypto Defense Alliance (CDA). AFX is working with blockchain security partners, including Zellic, which previously audited the bridge code. Ken / Supercube, Head of Growth at AFX, extended a white-hat settlement offer requesting the return of 70% of stolen assets to address 0x222B…9f1B, with 30% retained as bounty. No funds have been returned yet. The root cause remains under investigation; preliminary assessments from SlowMist and DefiLlama suggest compromised validator hot keys or private key compromise, classifying it as an infrastructure incident. AFX has not disclosed affected keys, validators, or user reimbursement plans.