The contract treated the withdrawal as valid and released the funds after a 200-second dispute period. The bridge did exactly what it was designed to do, but the keys authorizing were apparently in the wrong hands.
The attacker then bridged the stolen USDC to Ethereum and swapped it for about 12,467 ETH, worth roughly $24 million, which on-chain trackers say now sits in a single wallet.
AFX’s trading activity had been climbing sharply in the run-up to the attack, with daily perpetuals volume spiking to multi-month highs in mid-July, according to DefiLlama, as the protocol drew in users and, with them, deposits.
The roughly $24 million drained was almost the entirety of the protocol’s total value locked, meaning the attacker emptied the vault at close to the moment it was fullest.
The loss lands amid a punishing stretch for crypto security, with Q2 among the worst quarters for hacks on record and a run of Arbitrum-based protocols, including the oracle exploit that drained a separate $18 million from RWA platform Ostium a week earlier, hit in quick succession.
As such, the incident is a similar failure to the roughly $285 million Drift Protocol loss in April, where attackers spent months working their way to privileged access rather than breaking any contract.
