# AFX Trade Hacked for $24M in Bridge Validator Key Compromise

*AFX Trade was drained of approximately $24.15 million USDC on Arbitrum after attackers compromised its USDC custody bridge.*

By [ETH Daily News](https://ethdaily.io) · 2026-07-23

hack, arbitrum, usdc, exploit, security, bridge

---

AFX Trade, a perpetuals DEX on Arbitrum, [was drained](https://x.com/AFX_XYZ/status/2080126901205770734) of approximately $24.15 million USDC on July 22 after attackers compromised the hot-validator signing keys on its USDC custody bridge. Five compromised hot-validator signatures carrying 7,142 of 10,000 validator power met the required two-thirds quorum, authorizing a withdrawal that settled after the 200-second dispute window.

The stolen USDC was bridged to Ethereum via CCTP and swapped for roughly 12,467 ETH, representing nearly all of AFX's TVL. Arbitrum's native bridge was not involved and was not compromised. AFX has paused the bridge, engaged Blockaid, PeckShield, SlowMist, and Zellic, and offered a white-hat settlement of 30% (~$7.2M) for returning 70%.

Security researcher Tay Vano reviewed the Zellic audit and found zero test coverage, multiple acknowledged findings without fixes, and portions of the codebase that were never provided to auditors. Zellic's own summary stated they lacked confidence they had found everything given time constraints, out-of-scope components, and code they never ran. High severity vulnerabilities were found in out-of-scope components by automated tooling.

_This is a developing story._

* * *

Disclaimer: Content is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. No representations or warranties are made as to accuracy, completeness, or timeliness. Use of this content is at your own risk, and you should consult a qualified professional before making decisions. No fiduciary or advisory relationship is created.

---

*Originally published on [ETH Daily News](https://ethdaily.io/afx-trade-hacked-for-dollar24m-in-bridge-validator-key-compromise)*