Two Perps Exchanges, Two Weeks, Zero Bugs: The AFX Trade Drain

On July 22, 2026, an attacker pulled $24.15 million in USDC out of AFX Trade, an on-chain perpetuals exchange on Arbitrum, and bridged it to Ethereum as roughly 12,467 ETH. Blockaid flagged the drain at 21:30 UTC. The stolen funds nearly emptied the venue's total value locked, and they now sit in a single wallet while AFX offers the attacker a 30 percent bounty to send the rest home.

Here is the part worth sitting with: not one line of the exchange's code was broken. Blockaid's read is explicit, that the on-chain logic was never bypassed and the contracts did exactly what they were written to do. The withdrawal that emptied the vault carried valid signatures. It cleared quorum. It waited out the required dispute period and then finalized, precisely as designed. If you had handed AFX's bridge contract to an auditor the week before and asked whether it could be broken, the honest answer would have been no. And it wasn't. It was obeyed.

This is now a pattern with a date on it. One week earlier we wrote about Ostium, another on-chain perpetuals exchange on Arbitrum, drained for roughly $18 million through a compromised oracle signer feeding it future-dated prices (see The Input Is the Exploit: Ostium and DeFi's New Attack Surface). Two perps venues, two weeks, two eight-figure losses, and zero smart-contract bugs between them. The failure surface for on-chain perps is not the code that auditors stare at. It is the keys, the quorums, and the privileged authority sitting around that code.

What Actually Happened

AFX Trade ran its own bridge to move value between chains, and that bridge was secured by a validator set. To understand the drain you have to understand what those validators are for. A cross-chain bridge cannot see the other chain directly, so it appoints a set of validators whose signing keys attest that something happened elsewhere and authorize the corresponding release of funds. Reach an agreed threshold of those signatures, a quorum, and the bridge treats the withdrawal as legitimate and pays it out.

AFX's bridge required roughly a two-thirds quorum. The attacker obtained the hot signing keys of five validators, which was enough to clear that threshold. With quorum in hand, they submitted a withdrawal the bridge had no reason to distrust. Every signature on it was cryptographically valid, because every signature on it was real. The keys were authentic. They were simply in the wrong hands.

Then the second safeguard failed in the quietest way possible. AFX's bridge, like most modern designs, did not finalize instantly. It used an optimistic model: a signed withdrawal is provisionally accepted and enters a challenge window, a 200-second span in which any honest watcher can submit a fraud proof and stop it. The window is the entire safety net. It exists precisely so that a bad withdrawal, even one carrying valid signatures, can be caught and reversed before the money leaves.

Nobody challenged it. For 200 seconds the fraudulent withdrawal sat in plain view, and no watcher, human or automated, raised a hand. The window closed. The contract auto-finalized and released $24.15 million, which the attacker immediately bridged to Ethereum and swapped into ETH. The fraud proof that would have stopped the drain was a mechanism that existed on paper and depended on a vigilance that was not there when it mattered.

Why the Authority, Not the Code, Was the Vulnerability

It is tempting to call this a bridge bug, but that dilutes the lesson. The bridge worked. Trace the failure and every step executed correctly. The quorum check counted five valid signatures and found quorum, correctly. The challenge window opened for its full 200 seconds and received no challenge, correctly. The finalization logic released the funds to a withdrawal that was validly signed and never challenged, correctly. There was no reentrancy, no overflow, no broken access control, no signature that got replayed. The contract was not defeated. It was operated, by someone holding the authority it was built to obey.

That authority lived in two places, and both sat outside anything an audit is scoped to cover.

The first is the keys. These were hot validator keys, signing keys held on internet-connected machines so the validators could sign continuously as the bridge ran. Convenient, and reachable. How those five keys were captured has not been disclosed, so we will not guess at it, but the consequence is the point: whoever holds a quorum of a bridge's validator keys holds the bridge. There is no exploit left to write. When you already hold the signatures that open the vault, there is nothing left to break into. A contract audit reads the Solidity that checks the signatures. It cannot tell you where those signing keys are stored, who can reach the machines holding them, or whether a single spearphish separates an attacker from quorum.

The second is the watchers. An optimistic challenge window is only as strong as the party monitoring it, and that party is off-chain by definition. The 200-second delay is not a cryptographic guarantee. It is a bet that someone is paying attention and will act inside the window. The AFX drain is what it looks like when that bet loses: the mechanism functioned perfectly and protected nothing, because its security was never in the contract.

One clarifying detail underlines where the boundary sat. Offchain Labs co-founder Steven Goldfeder stated plainly that Arbitrum's native bridge was not hacked or exploited in any way. The compromise was entirely in AFX's own, self-operated bridge and its validator set. The chain's shared infrastructure held. The venue's private authority is what fell, which is exactly the surface a self-run validator set creates and a dev has to defend alone.

Where the Real Risk Lives on a Perps Venue

Stack Ostium and AFX Trade next to each other and the shared anatomy is hard to miss. Ostium trusted an oracle signer and got fed prices that never happened. AFX trusted a validator quorum and got fed a withdrawal nobody had the right to make. In both, the trading engine, the accounting, the settlement math all performed flawlessly. In both, the loss entered through a privileged input the system was built to believe: a signer, a quorum, a key.

That is the honest map of a perps exchange's attack surface. A perpetuals venue is a machine for moving collateral based on signals it does not itself produce, prices from an oracle, cross-chain balances from a bridge, finality from a validator set. Each of those trusted inputs is a signing authority, and each signing authority is a set of keys somewhere, held by someone, reachable through some path. That is where the money now leaves. The week of AFX's drain was not an isolated event either: roughly $47 million was drained across the tape in seven days, and six of the seven incidents traced back to infrastructure or off-chain authority rather than contract logic executing as designed. The code held. The keys did not.

So the discipline that actually reduces this risk is not another audit of the trading contracts. It is authority hygiene, and it is unglamorous work. Keep signing keys off internet-connected machines and behind hardware wherever the design allows, so a quorum cannot be assembled from a laptop. Isolate authorities so that no single compromise, one signer, one validator set, cascades into a total drain. If your safety net is an optimistic challenge window, treat the watcher that fires the fraud proof as critical infrastructure and run it like your funds depend on it, because for 200 seconds they do. And question every trusted input before you trust it: who can sign for it, where does that key live, and what is the worst thing an attacker can do with the authority you have already granted.

A venue that settles on regulated custody rails, with a qualified custodian holding the assets rather than a self-operated bridge and its own validator quorum, simply does not have five hot keys to steal or a challenge window to sleep through. You cannot compromise a validator set that does not exist.

This is the terrain we work in at 0xhades. We build and run keepers, searchers, and signing infrastructure in production, which means the question this drain raises is the one we live with daily: what does an automated system trust before it moves money, and where is the authority that lets it. Hardening that path is different work from reading a contract, and it is the work the last two weeks keep demanding.

The industry learned to audit the code and called it security. The attackers stopped fighting the code. They are collecting the keys that command it, waiting out the windows meant to stop them, and letting the contracts do the rest, faithfully.