On 22 July 2026, UNC4899 / TraderTraitor compromised AFX's custody bridge after a fake job approach led a developer to clone a malicious repository. The attacker persisted in AFX's JFrog infrastructure, used stolen credentials to abuse an operations bastion, and deployed malware to DEX validators, causing them to co-sign an unauthorized bridge transaction and transfer assets out of AFX custody. AFX said the compromise was confined to its own infrastructure and found no evidence that Arbitrum or the native Arbitrum bridge was breached.