The contract treated the withdrawal as valid and released the funds after a dispute period of 200 seconds. The bridge did exactly what it was designed to do, but the keys that authorized it were apparently in the wrong hands.
The attacker then converted the stolen USDC to Ethereum, exchanging it for about 12,467 ETH, worth about $24 million, which trackers on the chain say now sits in a single wallet.
AFX’s trading activity had surged leading up to the attack, with daily perpetuals volume rising to multi-month highs in mid-July, according to DefiLlama, as the protocol attracted users and, with them, deposits.
The roughly $24 million that was drained was nearly the entire protocol’s total value locked, meaning the attacker emptied the vault close to its peak.
The loss lands amid a punishing stretch for crypto-security, with Q2 among the worst quarters for hacks ever and a number of arbitrage-based protocols, including the oracle exploit that drained a separate $18 million from RWA platform Ostium a week earlier, hit in quick succession.
As such, the incident is a similar failure to the roughly $285 million Drift Protocol loss in April, where attackers spent months working their way up to privileged access rather than breaching any contract.
