Arbitrum Perp DEX AFX Loses $24M to Hacker, Offers 30% Bounty

DeFi Protocol Drained of $24 Million in Bridge Exploit

AFX Trade, a decentralized perpetuals exchange operating on the Arbitrum network and settling in the stablecoin USDC, was drained of $24.15 million on Wednesday due to an exploit targeting a bridge managed by the protocol, according to security firm Blockaid.

In a statement, AFX Trade indicated that the precise method of the attack is still under investigation. On-chain analysis reveals that the perpetrator bridged the stolen USDC to the Ethereum network and subsequently exchanged it for 12,468 ETH, which is now held in a single wallet, PeckShield reported.

AFX Trade acknowledged an incident involving its USDC custody bridge on Arbitrum. “Upon detecting the incident, we immediately suspended bridge operations and initiated our incident response procedures. Our engineering and security teams are actively investigating the root cause,” the protocol stated on X (formerly Twitter) on July 23, 2026.

Arbitrum moved swiftly to distance itself from the incident. Co-founder Steven Goldfeder clarified that the network’s native bridge “has not been hacked or exploited in any way,” emphasizing that the compromised transaction originated from a third-party protocol. A breach of Arbitrum’s core bridge would have wider implications across the entire layer-2 network, whereas a compromised application built on top represents a more contained failure.

AFX Trade suspended its bridge operations, stating that the damage appeared “isolated to the AFX-operated custody bridge.” The protocol stressed that its trading infrastructure, mainnet, and the Arbitrum network itself remained unaffected.

The firm added that it was collaborating with ecosystem partners and security firms to track the stolen assets. Hours later, AFX’s head of growth, Ken C, publicly offered the attacker a deal: return 70% of the stolen funds and keep the remaining 30% as a “white hat bounty.” Such public overtures have become a common tactic in cryptocurrency exploits, mirroring a similar attempt by Solana’s Drift Protocol following its $285 million hack in April.

This theft marks another significant loss in a challenging year for decentralized finance (DeFi), which has seen over $840 million lost to hacks in 2026. The incident also hits close to home for the Arbitrum ecosystem, as Ostium, another perpetuals venue on the network, was drained of $18 million just a week prior due to a compromised oracle key.