Overview
- On Wednesday, July 22, an AFX-operated cross-chain bridge released about 24,150,000 USDC to an attacker after on-chain records showed the bridge contract finalized the transfer.
- Investigators and on-chain trackers reported the attacker moved the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH, exposing the proceeds to Ether price swings.
- Security firms including Blockaid, PeckShield and Lookonchain and the Arbitrum team are coordinating with AFX to trace the funds but have not confirmed any recovery or seizure.
- Reporting indicates the breach was enabled by compromise of off-chain bridge signing keys that produced enough validator signatures to meet the bridge quorum and authorize the withdrawal.
- The incident adds to several 2026 bridge failures and raises fresh questions about third-party bridge authorization, possible use of token freezes, and broader trust in cross-chain deposit systems.