Blockaid detected an exploit on AFX, a third-party bridge protocol operating on Arbitrum, draining roughly $24.15 million in USDC. The on-chain security firm flagged the incident publicly as the funds moved out of the bridge's contracts.
Offchain Labs co-founder Steven Goldfeder confirmed that Arbitrum's native bridge was not the target and is not affected. The team said it is investigating the AFX incident, which sits on top of Arbitrum but operates independently of the core bridging infrastructure.
Why it matters
Third-party bridges have been the single most attacked surface in crypto, accounting for a disproportionate share of the largest DeFi exploits over the past three years. AFX is not part of the canonical Arbitrum stack, but losses of this size still feed into the broader bridge-risk discount that institutional allocators apply to L2 liquidity.
Market impact
The exploit lands on a USDC-denominated bridge, so the immediate market reaction runs through stablecoin liquidity and bridge credit rather than token price. Watch for USDC redemption queues on Arbitrum, any subsequent bridge pause by AFX, and whether Circle flags the addresses involved. The native Arbitrum bridge confirmation from Goldfeder is the part that caps contagion risk for the chain itself.
Frequently asked questions
-
What is AFX and is it the official Arbitrum bridge?
AFX is a third-party bridge protocol built on top of Arbitrum. It is not part of Arbitrum's native or canonical bridging infrastructure, which Offchain Labs confirmed was unaffected by the exploit.
-
How much was lost in the AFX exploit?
Blockaid detected roughly $24.15 million in USDC drained from AFX's bridge contracts on Arbitrum.
-
Was Arbitrum's native bridge hacked?
No. Offchain Labs co-founder Steven Goldfeder confirmed that Arbitrum's native bridge itself was not hacked or exploited and remains unaffected.
-
Who detected the AFX exploit?
On-chain security firm Blockaid publicly flagged the exploit as the funds moved out of AFX's bridge contracts.
-
How does this affect USDC liquidity on Arbitrum?
Because the exploit was USDC-denominated, the immediate read runs through stablecoin liquidity and bridge credit. Watch USDC redemption queues on Arbitrum, any AFX bridge pause, and whether Circle flags the receiving addresses.
CoinDesk
CryptoSlate
Crypto News
Lookonchain
WuBlockchain