Back
AFX Trade hacker swaps 655.4 ETH for 18.86 BTC after $24.15 million bridge exploit

AFX Trade hacker swaps 655.4 ETH for 18.86 BTC after $24.15 million bridge exploit

After AFX lost 24.15 million USDC in an Arbitrum bridge exploit, on-chain data now indicates the attackers converted the full 12,467 ETH haul into Bitcoin, broadening the wallet trail investigators are monitoring.

BTC
ETH
USDC

Fact Check
The specific numeric claim (655.4 ETH swapped for 18.86 BTC via THORChain) is reported consistently across Coincu, Bloomingbit, and PANews, all tracing to on-chain analyst EmberCN's report dated July 25, 2026. CoinDesk independently confirms the underlying exploit context: AFX Trade lost ~$24.15M USDC on July 23, 2026 via compromised bridge/validator signing keys, with funds converted to ~12,467 ETH. The convergence of the exact ETH-to-BTC figures and the corroborated exploit background strongly support the claim. The only limitation is that the swap detail derives from a single originating analyst source (EmberCN), though it is on-chain verifiable.
Summary

Wallets linked to the AFX Trade exploit have now converted 12,467 ETH into Bitcoin, extending an earlier move in which 655.4 ETH was swapped for 18.86 BTC through THORChain after AFX, an Arbitrum-based decentralized trading protocol, lost $24.15 million in USDC in a bridge hack. AFX said the incident was isolated to a third-party USDC custody bridge rather than its trading infrastructure, mainnet, or Arbitrum's native bridge, while preliminary findings published July 24 said the breach appeared to begin with coordinated social engineering in a development environment before escalating into internal build infrastructure and validator systems. The broader ETH-to-BTC shift means investigators tracking the stolen funds must now follow Bitcoin destinations as well as Ethereum- and Arbitrum-linked wallets. AFX had proposed a white-hat deal allowing the hacker to keep 30% if 70% of the assets were returned.

Terms & Concepts
  • THORChain: A protocol that lets users swap native assets across different blockchains without relying on wrapped tokens or centralized exchanges.
  • white-hat deal: A recovery arrangement in which an attacker is offered terms to return stolen funds in exchange for keeping an agreed share or receiving a bounty.
  • validator systems: Infrastructure that helps verify and process network activity.