AFX deposit bridge drained ~$24M USDC on Arbitrum
Update
Goodwill / recovery plan window (Aug 3)
15M custody-bridge drain would be unveiled around 3 Aug 2026.
Team post-mortem line: attack started with social engineering of a developer, then supply-chain / internal tooling, then compromised validators co-signing the bridge withdrawal: not a break of Arbitrum’s native bridge.
Treat compensation details as TBD until the official plan posts; fake “AFX claim / migrate” sites are phishing risk while recovery chatter is hot.
A third-party deposit rail for the AFX perp DEX was emptied of about 24.15 million USDC. Arbitrum’s own native bridge was not hit. Offchain Labs confirmed the bad transaction targeted AFX’s contract, not chain infrastructure.
369 take
“On Arbitrum” often means a custom deposit bridge, not the canonical bridge.
Short dispute windows and hot-validator-signed withdrawals are a full trust surface: treat them like mint authority before you deposit.
Off-chain ops compromise (social eng → build/deploy → validators) is as deadly as a bad Solidity bug.
Sources