Arbitrum Protocol AFX Suffers $24.15 Million Cross-Chain Bridge Hack

The Arbitrum ecosystem faced a significant security breach on July 23, 2026, after the AFX protocol fell victim to a sophisticated exploit. According to security firm Blockaid, the attack targeted the project's cross-chain bridge infrastructure, resulting in the theft of approximately 24.15 million USDC. The incident occurred at 05:30 AM Beijing time, prompting an immediate emergency response from both the protocol developers and the broader network security community to mitigate further losses.

Details of the AFX Bridge Exploitation

Initial investigations into the breach reveal that the attacker identified a vulnerability within the cross-chain communication layers used by AFX. This allowed for the unauthorized withdrawal of stablecoins from the protocol's liquidity pools. Security analysts at Blockaid monitored the movement of funds in real-time, confirming that the stolen assets were primarily held in USDC.

• The exploit took place at 05:30 AM (UTC+8) on July 23.
• Total losses are currently estimated at 24.15 million USDC.
• The vulnerability specifically affected the protocol’s proprietary bridge mechanism.
• Security teams are currently tracing the movement of assets to centralized exchanges.

Cross-chain bridges remain a frequent target for malicious actors in the DeFi space due to the complexity of smart contract interactions between disparate blockchain environments.

Coordinated Response and Fund Recovery Efforts

In the aftermath of the exploit, the Arbitrum core team and Offchain Labs have stepped in to assist with the recovery process. Steven Goldfeder, co-founder of Offchain Labs, confirmed via the X platform that the Arbitrum team is actively involved in the technical response. Efforts are currently focused on identifying the attacker's wallet addresses and coordinating with stablecoin issuers to potentially freeze the illicitly obtained funds.

Blockaid stated that they are cooperating with the Arbitrum team to respond to the incident, communicate with affected protocols, and assist in freezing the stolen funds.

The protocol developers have temporarily suspended bridge operations to prevent additional outflows while a comprehensive audit of the smart contract code is conducted. Affected users are advised to revoke any active permissions or approvals related to AFX contracts as a precautionary measure.

The AFX exploit underscores the ongoing security challenges facing Layer 2 (L2) ecosystems and the interoperability protocols that support them. As the investigation continues, the focus remains on the recovery of the 24.15 million USDC and the implementation of more robust security patches. The Arbitrum community continues to monitor the situation closely for official updates regarding potential compensation plans or technical post-mortems from the AFX development team.