Arbitrum-based perpetuals DEX AFX Trade was drained of $24 million this week in an exploit targeting its custody bridge. The attacker quickly moved the stolen funds to Ethereum. AFX has offered the hacker 30% of the haul to return the rest.
The exploit
The breach hit a custody bridge operated by AFX, not the Arbitrum network itself. That distinction matters — the underlying L2 wasn't compromised. Still, the damage is real: $24 million in user and protocol funds gone. The attacker bridged the stolen assets to Ethereum shortly after the exploit, likely to launder or cash out.
The response
AFX responded with an on-chain message offering the hacker 30% of the stolen amount as a bounty if they return the remaining 70%. It's a common tactic in crypto heists — a way to recover funds without a drawn-out legal fight. The offer is time-limited, though AFX hasn't said how long the window is. The exchange has paused withdrawals and is working with security firms to trace the funds.
AFX hasn't announced a timeline for reopening withdrawals. The hacker has until the bounty deadline to decide. If they don't take the deal, AFX will likely pursue legal and forensic avenues. For now, users are stuck waiting — and the $24 million hole raises questions about the security of custody bridges in the DeFi ecosystem.
