AFX Trade Bridge Exploit Drains 24.15M USDC, Attacker Converts to 12,467 ETH

AFX Trade, a protocol built on Arbitrum (ARB), lost approximately 24.15 million USDC on July 22 after an attacker exploited a bridge operated by the platform. Security firm Blockaid flagged the exploit at 21:30 UTC, and blockchain investigators traced the stolen funds as the attacker moved to cash out.

According to security firm PeckShield, the attacker bridged the drained assets from Arbitrum over to Ethereum and swapped them for 12,467 ETH, converting the stablecoin haul into a volatile asset that is harder to trace and freeze once dispersed across wallets.

July’s Hack Tally Already Tops June

The AFX Trade incident marks the 14th recorded crypto security breach in July alone, a figure that has already pushed the month’s total hack losses past all of June’s combined tally. The pace underscores a persistent pattern: bridge and cross-chain infrastructure remain among the most targeted attack surfaces in DeFi, since they concentrate large pools of liquidity behind smart contracts that must reconcile assets across two separate ledgers.

For holders and liquidity providers on Arbitrum-based protocols, the exploit is a reminder that even mid-sized platforms handling tens of millions of dollars in stablecoin flow can become single points of failure if bridge contracts are not sufficiently audited or monitored in real time.

Why the ETH Conversion Matters

Converting roughly 24 million USDC into 12,467 ETH is a common laundering step for attackers, since stablecoin issuers can freeze compromised addresses but native ETH cannot be frozen at the protocol level. Once the funds sit in ETH, the attacker gains more flexibility to route them through mixers, decentralized exchanges, or cross-chain bridges before any centralized exchange can flag the wallet.

Blockaid’s real-time flagging at 21:30 UTC gave the broader security community early visibility into the exploit, but the swap to ETH had already been executed, illustrating how narrow the window is for on-chain responders to intervene once a bridge contract is drained.

What It Means for Arbitrum Users

Neither AFX Trade nor Arbitrum’s core infrastructure has confirmed a remediation plan or reimbursement path for affected users as of this report. Traders holding positions on protocols tied to the exploited bridge should watch for official statements on frozen funds, potential compensation, or contract migrations before assuming normal service has resumed.

With 2026’s hack losses climbing month over month, the AFX Trade breach adds to a growing list of bridge-related incidents that continue to test investor confidence in cross-chain DeFi infrastructure, even as total value locked across such protocols keeps growing.

Sources

• beincrypto.com
• theblock.co