AFX Trade: A Fake Job Offer and Five Stolen Keys Took $24.15M

On 9 July 2026 a developer at AFX Trade was approached by someone posing as a recruiter from a company called Oddium Lab. As part of the conversation, the developer was asked to copy a piece of code to their own computer. The code carried a hidden program. Thirteen days later, at 21:27 UTC on 22 July, five of the machines that guard AFX Trade's money signed a withdrawal nobody at AFX had asked for. Three minutes after that, the security firm Blockaid raised the alarm: 24,150,000 USDC, about $24.15 million in digital dollars, had left the exchange.

AFX Trade was a young trading platform for perpetual futures, or perps: bets on whether the price of Bitcoin, Ether or other assets will rise or fall, usually made with borrowed money, that never expire. A share trader would recognise them as close cousins of contracts for difference. AFX ran on Arbitrum, a cheaper add-on network built on top of Ethereum, and settled everything in USDC, a stablecoin, a token designed to always be worth one US dollar. CoinDesk reported that the amount taken was nearly all of the money held on the platform.

How the money was guarded

Customers did not hand their dollars straight to AFX's trading system. They went through a bridge that AFX ran itself, a custody account that holds deposits and releases them when a withdrawal is approved, much like a bank's payments desk. The bridge went live on 12 May 2026, and AFX announced on 3 June that the security firm Zellic had audited its code.

Withdrawals needed approval from validators, a group of computers run by the bridge operators, each holding a signing key, a secret code that works like a signature. Think of a company whose large payments need sign-off from most of its directors. The rule was a supermajority: signers holding at least 6,667 of 10,000 units of voting power, two-thirds, had to approve. As a last line of defence, every withdrawal then waited through a 200-second dispute window, a short cooling-off period, like a cheque clearing, during which anyone could object and stop it.

The keys were "hot", meaning they lived on computers connected to the internet so the validators could sign quickly. That was the weakness.

From a job offer to the vault

AFX later published an account of the intrusion. The repository the fake recruiter sent contained a booby-trapped setting that ran hidden code during a routine step, giving the attacker a foothold on the developer's workstation. Days later the attacker downloaded AFX's source code. Next, a malicious plug-in was planted on JFrog, the internal service AFX used to store and distribute its software, giving the attacker the ability to run commands on AFX's systems. The plug-in caused repeated memory crashes that staff treated as ordinary technical faults, so it survived restarts. The attacker replaced system files, tried to wipe security logs, and finally used an internal management tool that had privileged access to the validator machines to push malicious code onto some of them.

On 22 July, five validators, holding 7,142 of the 10,000 units of voting power, signed a withdrawal of the bridge's entire balance. That cleared the 6,667 threshold. The 200-second window opened. Nobody objected. When it closed, the bridge paid out automatically, exactly as designed. Blockaid stressed that the bridge's code had done what it was built to do; the failure was in the keys.

The money moved in six transfers, through Circle's CCTP, a service that destroys USDC on one network and issues the same amount on another, to Ethereum. There it was swapped through UniswapX, an automated trading service, into about 12,467 ether at an average of roughly $1,937 each, and gathered into one wallet. Days later, according to Rekt News, the attacker split it across roughly two dozen addresses, a step in hiding the trail.

North Korea's playbook

AFX said its findings were consistent with UNC4899, also called TraderTraitor, a hacking group linked to North Korea and tracked by Mandiant, Microsoft Threat Intelligence, the FBI and the US cybersecurity agency CISA. The investigators zeroShadow and SEAL, a volunteer emergency response group, separately called the link "highly likely", according to Rekt News, which described the attribution as preliminary. The method fits the record: the FBI has blamed the same group for the theft of 4,502 bitcoin from the Japanese exchange DMM Bitcoin in 2024, which also began with a fake recruiter sending a coding "test" to an employee of Ginco, the Japanese firm whose software DMM used to manage its wallets.

Steven Goldfeder, co-founder of Offchain Labs, the company behind Arbitrum, said Arbitrum's own bridge "has not been hacked or exploited in any way". The transaction came from a third-party protocol. Security researcher Taylor Monahan criticised the Zellic audit for gaps in test coverage, and AFX's own documentation said the audit covered only the bridge contract, not the wider system the attacker actually used.

Asking for the money back

Within hours AFX's head of growth, who posts as Ken C, made a public offer: return 70% and keep 30%, about $7.2 million, as a "white hat bounty", a reward normally paid to hackers who report or return what they find. There is no record of a reply. On 31 July AFX said it would publish a "goodwill plan" for affected users on 3 August, and that "AFX investors, the team, and early supporters are all deeply affected by the situation." It said it had rebuilt the affected systems, changed its credentials, moved production into a more isolated setup and planned staff training on social engineering. The details of the goodwill plan were not widely reported, and as of 16 October 2026 no recovery of funds, reopening of the bridge or arrest had been publicly confirmed.

AFX was the second Arbitrum perps platform robbed in a week. On 15 July Ostium lost $23.75 million when an attacker used a stolen price-feed key, and the next day after AFX the Verus-Ethereum bridge lost $7.54 million. In none of these cases was the main smart contract code broken. The attackers went after the people and machines holding the keys.