Overview
- AFX’s custody bridge on Arbitrum was breached and about $24.15 million in USDC was withdrawn after attackers obtained validator signing keys, according to on‑chain forensics and Blockaid.
- Hours later the Verus Ethereum bridge paid out roughly $7.54 million by abusing its import path, an attack Blockaid says appears tied to the same class of validation flaw seen in May.
- After the AFX theft the attacker moved the USDC to Ethereum and swapped it into about 12,467 ETH, consolidating proceeds into a single wallet while security teams trace the flow.
- AFX suspended its USDC bridge and publicly offered a 70/30 white‑hat deal to recover funds, Offchain Labs confirmed Arbitrum’s native bridge was not compromised, and forensic investigations are ongoing.
- The cases underscore a broader trend this year: third‑party bridge infrastructure, hot keys and validator permissions are concentrated points of failure that can bypass smart‑contract audits and put user funds at risk.