AFX deposit bridge drained ~$24M USDC on Arbitrum
A third-party deposit rail for the AFX perp DEX was emptied of about 24.15 million USDC. Arbitrum’s own native bridge was not hit. Offchain Labs confirmed the bad transaction targeted AFX’s contract, not chain infrastructure.
Update (2026-08-03) — Goodwill / recovery plan window (Aug 3): AFX said a goodwill plan for users hit by the ~$24.15M custody-bridge drain would be unveiled around 3 Aug 2026. Team post-mortem line: attack started with social engineering of a developer, then supply-chain / internal tooling, then compromised validators co-signing the bridge withdrawal — not a break of Arbitrum’s native bridge. Treat compensation details as TBD until the official plan posts; fake “AFX claim / migrate” sites are phishing risk while recovery chatter is hot.
369 take: “On Arbitrum” often means a custom deposit bridge, not the canonical bridge. Short dispute windows and hot-validator-signed withdrawals are a full trust surface — treat them like mint authority before you deposit. Off-chain ops compromise (social eng → build/deploy → validators) is as deadly as a bad Solidity bug.