EmberCN said the hacker behind the AFX Trade exploit has converted 12,467.4 ETH into BTC. The move followed the July 23 attack on AFX Trade’s Arbitrum bridge, which resulted in losses of about 24 million USDC. After the exploit, the attacker gradually moved the stolen funds from Arbitrum to Ethereum before carrying out the ETH-to-BTC swap. The update tracks how the stolen assets have been handled after the breach and points to continued fund movement across chains after the initial attack.

Decentralized perpetuals exchange AFX lost more than $24 million after its cross-chain bridge was hacked, an amount that roughly matched the protocol’s full TVL on DefiLlama. After the incident, AFX said on X that it was working with security firms, ecosystem partners, exchanges and relevant authorities to monitor fund flows and assist the investigation. Attention quickly shifted to AFX’s June 3 audit report from Zellic. The report said 11 issues had been identified, including two critical findings, one high-severity issue and six medium-severity issues. Zellic also stated that the review covered only part of the bridge protocol, did not test all security-critical paths and could not be performed in a live or local runtime environment. That meant the firm could not fully assess core areas such as custody, signature checks and permission controls, nor confirm whether fixes were correctly implemented later. ChainCatcher also outlined several public clues suggesting a close relationship between AFX and crypto exchange Phemex, including team-account connections, now-deleted Phemex blog posts promoting AFX, and similarities in brand design. The report noted that Phemex itself was hacked for more than $70 million in January 2025, when outside analysis said North Korean hackers were the likely culprit. It added that more evidence would be needed to determine whether the latest case was another external attack or involved insiders.

AFX Trade said its initial investigation found that the earlier incident involved a coordinated social engineering attack combined with an infrastructure breach. According to the company, the attacker appears to have first gained access through the development environment, then escalated privileges into internal build infrastructure and validator systems. The team said its immediate focus is protecting affected users. It is now verifying impacted balances, trying to recover funds, and preparing a structured remediation plan. Earlier, Foresight News reported that blockchain security firm PeckShield had detected a hack targeting AFX Trade’s Arbitrum bridge, with losses estimated at about 24 million USDC. The latest statement adds the platform’s first outline of how the intrusion may have unfolded and what its response priorities are.

The wallet tied to the AFX Trade exploit has started rotating funds again, this time moving from ETH into BTC through THORChain, according to monitoring by EmberCN. The latest activity follows the July 23 hack of AFX Trade’s bridge, in which 24.15 million USDC was stolen. Those funds were later converted into 12,467.4 ETH. EmberCN said the attacker began using THORChain about an hour before the update to cross-chain swap ETH for BTC. So far, 655.4 ETH has been exchanged for 18.86 BTC. The sequence outlined in the monitoring update shows a clear shift in the composition of the stolen assets, from USDC to ETH and now partly into BTC.

Onchain Lens said in a post on X that 224 publicly disclosed crypto hacking incidents were recorded in the first half of 2026, with total losses reaching about $1.32 billion. The largest losses came from access control failures, phishing attacks and oracle-related issues. Within the access control category, compromised permissions and privileged access were tied to several of the biggest incidents, including Kelp DAO with losses of $292 million and Drift Protocol with $280 million. Other named cases in that group included Humanity Protocol, Step Finance, Truebit, Resolv Labs, AFX and BonkDAO. Onchain Lens also said social engineering attacks caused $282 million in losses. For oracle-related incidents, the post listed Ostium, Blend Protocol and Bonzo. The data points to a familiar pattern in crypto security: a small number of incidents accounted for a large share of total losses, with compromised permissions and privileged access standing out among the costliest attack vectors disclosed during the period.

AFX, a high-performance sovereign L1 built for decentralized derivatives, has launched its Mainnet Points Program. The multi-season system rewards genuine ecosystem participation—trading, liquidity provision, and community engagement—with points redeemable for tokens at TGE.

AFX Trade, Verus Bridge, and B² Network previously lost a combined $35.56 million in separate attacks, and the latest update says the attacker has moved the stolen funds across chains into a mixer. Some of the assets have already been recovered. Verus Bridge and other affected protocols have suspended interaction functions while project teams work with security firms to trace the funds. A security analysis report has also been issued. In Verus Bridge’s case, the protocol was hit twice in three months through the same vulnerability. The team said it will restore services as soon as possible and compensate affected users.

DeFi protocols lost more than $35 million over the past 24 hours after attacks on Verus bridge, AFX’s USDC bridge on Arbitrum, and BSquared’s staking contract. Verus was hit for over $7.5 million just two months after an earlier exploit that drained $11 million, with SlowMist saying both incidents stemmed from flawed cross-chain import validation. AFX then lost more than $24 million after what BlockSec described as a malicious use of authorized validator keys, while BSquared suffered a nearly $4 million loss tied to unauthorized access to staking contract upgrade authority. In all three cases, projects moved quickly to contain damage, but the response has also revived debate over post-hack bounty offers. Verus previously recovered part of its stolen funds after a 25% bounty, and AFX is now offering 30% of the remaining assets, or $7.2 million, as a white hat bounty. Security expert Taylor Monahan questioned whether such terms make sense, arguing they may do little for legitimate researchers and could create the wrong incentives.