AFX Trade — Arbitrum USDC bridge validator key compromise

Timeline: On July 22, 2026 at 21:30 UTC, Blockaid detected an exploit targeting the AFX Trade perpetuals DEX bridge on Arbitrum. The attacker had pre-staged the Operator-EOA since May 12, 2026. At T0, they used 5-of-7 compromised hot-validator signatures to meet quorum and authorize a withdrawal of 24,150,000 USDC — virtually the entire bridge TVL of ~$24.18M. The funds cleared the ~200-second dispute window without contest. The USDC was aggregated by Attacker Safe (0x2f2974fa...feefc) and routed through BridgingKit (0xb3fa262d...af3f0) in 6 tranches across the Circle CCTP v2 bridge to Ethereum between 21:33–21:38 UTC. On Ethereum, the Safe swapped all USDC into ~12,467.5 ETH (~$1,937/ETH average) via a DEX aggregator between 21:34–21:41 UTC, then forwarded 12,467.437 ETH to the final holding wallet 0x627654B2782bfC57580ecD11d40869b350B6ebAC at 21:42 UTC. Offchain Labs co-founder Steven Goldfeder confirmed the Arbitrum native bridge was not involved. AFX suspended the bridge and on July 23 publicly offered the attacker a 70/30 white-hat split (return 70%, keep ~$7.2M bounty). Funds remained immobile for 3 days. On July 25, the attacker began laundering: ETH was fanned out into ~12 near-equal tranches (~100–600 ETH each) that converged on the THORChain Router (0xd37bbe57...), where streaming swaps converted ETH to native Bitcoin across 5 distinct BTC addresses. By July 25 noon, ~57% (~$14M) had been moved through THORChain to Bitcoin. zeroShadow and SEAL publicly attributed the attack to North Korean APT group UNC4899 / TraderTraitor; AFX confirmed this attribution.