Key facts
- AFX Protocol reportedly lost $24.15 million in a bridge exploit on Arbitrum.
- The exploit targeted a third-party protocol, not Arbitrum's native bridge infrastructure.
- An attacker gained access to a compromised oracle signer private key within Ostium.
- The attacker used falsified, future-dated price reports to fabricate trading profits.
- Approximately $18 million to $24 million in USDC was withdrawn from Ostium's OLP vault.
- The stolen funds were bridged to Ethereum and converted to ETH, with much sent to Tornado Cash.
AFX Protocol, a decentralized perpetual exchange operating on the Arbitrum network, reportedly suffered a loss of approximately $24.15 million due to an exploit targeting one of its cross-chain bridges. Security firm Blockaid detected the incident on July 15, 2026, around 9:30 p.m. UTC. The exploit involved a compromised oracle signer private key within the Ostium protocol, a decentralized exchange focused on real-world asset trading built on Arbitrum.
The attacker utilized the compromised key to authorize a future-dated, falsified price report. This allowed the attacker to create artificial trading profits on the Ostium platform, leading to the withdrawal of approximately $18 million to $24 million in USDC from Ostium's liquidity vault, known as the OLP. The stolen funds were then bridged to Ethereum, converted to ETH, and a significant portion was sent to Tornado Cash.
Offchain Labs, the developer of Arbitrum, confirmed that the incident affected a third-party protocol and did not impact Arbitrum's native bridge infrastructure. Stephen Goldfeder, co-founder of Offchain Labs, emphasized that the Arbitrum network's core infrastructure remained secure. Ostium founder Kaledora confirmed the breach occurred within a five-minute window and that the team had trading contracts paused within the hour.
In the aftermath, Ostium halted all trading operations and froze affected positions. The exploit, while significant for Ostium and its liquidity providers, is considered a contained problem rather than a systemic risk to the Arbitrum ecosystem. The ARB token experienced a decline of approximately 4% following the news, which analysts attributed to a knee-jerk reaction.