A decentralized perpetuals exchange built on Arbitrum called AFX Trade lost roughly $24 million in a security breach this week, prompting the platform to publicly offer the attacker a bounty to return the stolen assets.
How the Exploit Unfolded
The attack targeted a custody bridge operated by AFX Trade rather than a vulnerability in the underlying Arbitrum network. Once the funds were siphoned off, the perpetrator wasted little time moving the proceeds across chains, bridging the stolen assets to Ethereum in an apparent effort to obscure their trail and complicate any recovery attempt.
Bridges, which connect separate blockchains and hold pooled assets in transit, have repeatedly proven to be among the most tempting targets for attackers in the crypto sector. Because they concentrate large sums in a single contract or custody arrangement, a single flaw can expose enormous value.
When a bridge fails, the losses tend to be measured in the millions, not the thousands.
The Bounty Offer
In a move that has become increasingly common after major breaches, AFX Trade extended a proposal to the hacker: return the bulk of the funds and keep a portion as a so-called white-hat reward. The exchange offered to let the attacker retain 30% of the haul, which would leave the platform recovering the remaining 70%.
Such offers function as a pragmatic gamble. Rather than pursuing costly and often fruitless legal or forensic routes, victimized protocols frequently dangle a percentage as an incentive, effectively treating the theft as a bug bounty after the fact and hoping the attacker accepts a guaranteed payout over the risk of laundering tainted coins.
- The breach drained approximately $24 million from AFX Trade.
- The stolen funds were bridged from Arbitrum to Ethereum.
- AFX offered the attacker 30% of the total to return the rest.
What It Means for Users
The incident adds to a long list of bridge and custody-related exploits that have plagued the industry, reinforcing concerns about the security of infrastructure that sits alongside otherwise robust base-layer networks. For AFX Trade users, the outcome now hinges largely on whether the attacker takes the deal or attempts to cash out the full amount.
Whether the bounty offer succeeds remains uncertain, and recovery is far from guaranteed. The episode underscores that even as decentralized exchanges