AFX Trade Bridge on Arbitrum Loses $24.15 Million After Validator Signatures Are Compromised

AFX Trade, a decentralized perpetual-futures venue built on the Ethereum layer-2 network Arbitrum, lost roughly $24.15 million on Wednesday after an attacker drained one of the cross-chain bridges the protocol operates, according to the security firm Blockaid and reporting by CoinDesk.

The mechanism was not a smart-contract logic flaw but a control-of-keys failure. Investigators said the attacker held enough of the bridge's hot-validator signatures to authorize a single 24.15 million USD Coin (USDC) withdrawal. In practice, that means the multi-signature threshold protecting the bridge was met by keys the attacker controlled, so the contract executed the transfer as designed. The stolen USDC was then bridged from Arbitrum to Ethereum and swapped for 12,467 Ether, a standard laundering step that converts a freezable, issuer-controlled stablecoin into a harder-to-freeze asset.

Offchain Labs co-founder Steven Goldfeder said the Arbitrum native bridge was not hacked or exploited, stressing that the compromised component was a separate bridge that AFX itself runs. That distinction matters. The security of a layer-2's canonical bridge is a systemic property, while a single application's bridge is an isolated counterparty risk. AFX, Blockaid and Arbitrum teams are tracing the funds, and no recovery or attribution had been confirmed at publication.

The loss follows a pattern the desk has tracked closely. Bridges concentrate value and depend on a small set of signing keys, which makes signature or key compromise, rather than reentrancy or oracle manipulation, the recurring root cause of the largest decentralized finance (DeFi) drains.