The contract considered the withdrawal valid and released the funds after a 200-second dispute period. The bridge did exactly what it was designed to do, but the keys enabling it were apparently in the wrong hands.
The attacker then linked the stolen USDC to Ethereum and exchanged it for approximately 12,467 ETH, worth approximately $24 million, which on-chain trackers now know is in a single wallet.
AFX’s trading activity had increased sharply before the attack, with daily volume in perpetuals hitting multi-month highs in mid-July, according to DefiLlama, as the protocol attracted users and, with them, deposits.
The approximately $24 million drained represented almost all of the protocol’s total value locked, meaning the attacker emptied the vault almost the moment it was full.
The loss comes amid a difficult period for crypto security, with the second quarter among the worst quarters for hacks on record and a series of Arbitrum-based protocols, including the Oracle exploit that drained a separate $18 million from the RWA Ostium platform a week earlier, hit in rapid succession.
As such, the incident is a failure similar to Drift Protocol’s approximately $285 million loss in April, where attackers spent months seeking privileged access rather than breaking a contract.
