Hacker Drains $24M From Arbitrum Perp DEX AFX, Gets Offered 30% to Return It

Hacker Drains $24M From Arbitrum Perp DEX AFX, Gets Offered 30% to Return It

Another day, another DeFi exploit, and this one stings. AFX Trade, a perpetuals decentralized exchange operating on Arbitrum, has been drained of $24 million in what is shaping up to be one of the more painful bridge hacks of the year. The team is now doing what exploited protocols increasingly do in desperation: negotiating with the attacker directly, offering to let them keep 30% of the stolen funds if they return the rest.

That is a $7.2 million "thank you for your honesty" offer, and the clock is ticking.

### What Actually Happened

Despite the Arbitrum association, the network itself was not compromised. The vulnerability was in a custody bridge that AFX operates independently, a critical distinction that matters for how users and investors assess risk across the broader Arbitrum ecosystem.

Bridges remain the weakest link in DeFi infrastructure. They sit at the intersection of multiple chains, handle large pools of assets, and are notoriously difficult to audit comprehensively. The AFX bridge was apparently no exception.

Once the funds were lifted, the attacker wasted no time moving them to Ethereum, the go-to destination for hackers looking to gain distance and begin the murky process of obscuring transaction trails through mixers or fragmented wallet activity. On-chain analysts are almost certainly tracking every move right now.

### The 30% Bounty Play

The offer of a 30% bounty, roughly $7.2 million, is increasingly common in post-exploit negotiations. It reflects a brutal calculus: recovering 70% of stolen funds is far better than recovering nothing, which is the realistic outcome if the hacker chooses to vanish. Prosecutors and blockchain forensics firms have improved at tracing funds, but converting and laundering $24 million without leaving a trail is genuinely difficult.

Whether the hacker bites is another question entirely. Some do. Many do not.

### What This Means for DeFi and Layer 2 Markets

For traders and liquidity providers watching from the sidelines, this exploit is another reminder that bridge infrastructure is still the most dangerous real estate in crypto. Layer 2 networks like Arbitrum have made enormous strides in security and throughput, but the bridges and custody layers built on top of them do not automatically inherit those guarantees.

The incident is unlikely to shake confidence in Arbitrum broadly, but it will and should prompt harder questions about how perp DEXs manage their custody architecture. Users deserve clear disclosure about where the actual risk sits.

With DeFi total value locked still recovering across the board, events like this chip away at retail confidence at exactly the wrong moment. Every exploit that makes headlines is another reason a cautious investor stays on the sidelines.

The crypto market does not need more reasons for hesitation right now. AFX Trade needs its hacker to grow a conscience. Neither outcome is guaranteed.