AFX Trade hack — July 2026

AFX Trade, a perpetuals exchange operating on Arbitrum, lost 24.15 million USDC on 22 July 2026 when attackers gained control of the validator set behind the custody bridge it operates. The bridge is AFX's own infrastructure. Offchain Labs chief executive Steven Goldfeder stated publicly that Arbitrum's native bridge had not been hacked or exploited and that the compromised component belonged to a third-party protocol.

AFX's post-mortem sets out the early intrusion chain. On 9 July a developer was contacted on Telegram by someone posing as a recruiter and was induced to clone a repository from git.oddium.io containing hidden malicious configuration; FinanceFeeds names the fake employer as Oddium Lab. The attacker used that foothold to obtain AFX's source code, and on 16 July uploaded a malicious Groovy plugin, ops_maintenance.groovy, to the company's JFrog artifact repository, gaining code execution inside the software delivery pipeline. Persistence was maintained through a modified gssproxy process and injected libraries. FinanceFeeds reports that the attacker then reached an internal Ansible-based management service that already held privileged access to validator nodes and pushed payloads that interfered with consensus-message handling.

At about 21:27 UTC on 22 July the compromised validators co-signed a withdrawal from the custody bridge. The security firm Blockaid found that five hot-validator signatures authorised the transfer, clearing the roughly two-thirds quorum the bridge required; the contract verified the signatures and executed as designed. The USDC was bridged to Ethereum and swapped for roughly 12,467 ETH, reported by PeckShield as sitting in a single address.

AFX suspended bridge operations and offered the attacker a settlement allowing them to retain 30 percent, about $7.2 million, in exchange for returning the rest. No return was reported. AFX said its forensic findings were consistent with independent attribution of the intrusion to UNC4899, also tracked as TraderTraitor, a North Korea-linked group tracked by Mandiant, Microsoft Threat Intelligence, the FBI and CISA. A recovery plan for affected users was promised for 3 August 2026.