AFX Trade on Arbitrum drained $24m via bridge key compromise
AFX Trade, an Arbitrum-based decentralized perpetuals exchange that settles in USDC, was drained of about $24.15 million after an attacker compromised validator signing keys for a bridge the protocol uses. On-chain data shows the attacker obtained enough hot-validator signatures to approve a withdrawal and move the funds to a single wallet.
Security firm Blockaid said the bridge’s on-chain logic was not bypassed: five hot-validator signatures met the bridge’s ~two-thirds quorum, and the contract released funds after a 200-second dispute window. Arbitrum’s team (Offchain Labs co-founder Steven Goldfeder) stated the Arbitrum native bridge was not hacked; the incident appears confined to a third-party protocol running on top of Arbitrum.
The attacker bridged the stolen USDC to Ethereum and swapped it for roughly 12,467 ETH, nearly emptying AFX Trade’s total value locked at close to its daily peak. The theft arrives amid a broader wave of high-profile Arbitrum-related security incidents, including a previous $18 million exploit affecting Ostium.
For traders, the key takeaway is that AFX Trade’s failure was bridge-key/validator-signature governance related rather than a broken bridge code path—raising near-term counterparty and bridge-risk scrutiny for Arbitrum DeFi positions, especially those reliant on hot-signature approval flows.
Bearish
This is likely bearish for risk sentiment in Arbitrum DeFi, because a large portion of AFX Trade’s TVL was drained quickly after validator hot-signature approvals were compromised. Even though Arbitrum’s native bridge code was reportedly not broken, traders tend to price in “bridge and governance” tail risks across protocols that rely on hot-validator signing or third-party bridge setups.
In the short term, expect heightened caution around USDC settlement perps, lower willingness to deposit, and a possible liquidity pullback in Arbitrum-based venues—similar to how prior bridge/privilege-access events (e.g., large losses where attackers abused privileged access rather than contract bugs) caused fast de-risking. Losses near TVL peaks also amplify FUD because the protocol appears most vulnerable when activity is strongest.
Longer term, market impact depends on how quickly affected protocols strengthen signing/monitoring, whether disputes are processed smoothly, and whether regulators or major DeFi security providers drive standards for bridge key management. Absent clear remediation signals, recurring incidents can keep a risk premium on Arbitrum bridge-dependent products, weighing on broader L2 sentiment.