In a major multi-chain security breach, AFX Trade, a third-party cross-chain bridge operating on Arbitrum, was drained of $24.15 million in USDC.
The attack occurred when an external threat actor successfully compromised the off-chain infrastructure hosting 5 out of 9 validator nodes. By controlling a 5-node quorum, the attacker generated valid cryptographic signatures authorizing a massive withdrawal from the bridge's vault contract. The stolen USDC was immediately converted into Ethereum (ETH) across decentralized exchanges to maximize liquidity and prepare for laundering. Offchain Labs confirmed that Arbitrum's native rollup bridge remained completely unaffected. The Pipeline to Crypto Theft
This incident serves as a textbook example of Multi-Sig Quorum Hijacking in Web3 bridge design:
1. Off-Chain Server Credentials Breach
The smart contracts governing the bridge performed as programmed; they verified that 5 valid signatures were present before releasing the funds. The security failure occurred entirely off-chain, where attackers compromised server hosting environments, API keys, or cloud KMS instances managing the individual validator nodes.
2. Rapid Onchain Liquidation & Swapping
Once the unauthorized withdrawal request is approved by the compromised validator quorum, the attacker invokes the bridge's payout function on the destination chain. The stolen assets are instantly swapped into native gas tokens (ETH) via automated DEX aggregators (like 1inch or Uniswap) to prevent centralized stablecoin issuers (such as Circle or Tether) from blacklisting the funds.