AFX Trade, a decentralized finance platform, is offering a $7.2 million bounty to the hacker who stole $24 million in USDC from its cross-chain bridge on Arbitrum. The exploit, which occurred after compromised validator keys gave the attacker control, has left the project scrambling to recover the majority of the stolen funds.
How the bridge was broken
The bridge is designed to lock tokens on one blockchain and mint them on another. Validator keys are the cryptographic credentials that authorize these transfers. In this case, the attacker gained access to those keys and used them to approve a fraudulent withdrawal, draining 24 million USDC from the bridge's reserves on Arbitrum. The project confirmed the breach but hasn't disclosed exactly when it happened or how the keys were compromised.
The 30% bounty deal
AFX Trade's offer is straightforward: return 70% of the stolen funds — roughly $16.8 million — and keep the remaining 30% as a bounty, worth about $7.2 million. This kind of deal is common in crypto heists. Projects hope the hacker will take the guaranteed payout instead of trying to launder the full amount. So far, there's no word on whether the exploiter has responded.
What's at stake for the exploiter
The attacker now faces a choice. Accepting the bounty means walking away with $7.2 million, no questions asked. Refusing means trying to keep all $24 million, but that comes with the risk of being tracked, frozen, or pursued. Blockchain transactions are public, and exchanges can freeze USDC if they know it's stolen. The bounty offer gives the hacker a clean exit — if they take it.
Unanswered questions
AFX Trade hasn't set a public deadline for the bounty offer. It also hasn't said whether it has contacted law enforcement or if it has any technical means to reverse the transaction. The project hasn't detailed how it plans to secure the bridge going forward. For now, the stolen USDC remains in the hacker's control, and the crypto community is watching to see if the deal goes through.
