AFX Trade drained of $24M, offers hacker 30% bounty to return stolen funds

AFX Trade, a decentralized perpetuals exchange built on Arbitrum, got cleaned out to the tune of $24.15 million on July 22. The attacker compromised validator signing keys for the platform’s bridge, drained USDC from the protocol, bridged it all to Ethereum, and promptly swapped it for approximately 12,467 ETH at an average price of around $1,937 per token. The platform’s response? A public offer to let the hacker keep 30% of the stolen funds, roughly $7.2 million, if they return the remaining 70%. What happened and how the exploit worked The attack targeted a third-party bridge operated by AFX Trade, not Arbitrum’s native bridge infrastructure. Arbitrum itself wasn’t breached, and its core bridging mechanism remains intact. The vulnerability lived in the layer AFX maintained on top of it. The attacker gained access to validator signing keys for the AFX-operated bridge, which meant they could move funds out without restriction. The $24.15 million in USDC was bridged from Arbitrum to Ethereum and converted into ETH. The exploit follows a familiar playbook. A similar attack hit the Verus-Ethereum bridge back in May 2026, using a comparable method to drain funds. Security firm Blockai...