AFX attributes its July 2026 custody-bridge theft to UNC4899 / TraderTraitor after a developer cloned a malicious DEX repository offered through a fake job approach. A modified Git post-checkout hook launched the initial payload, and the attacker later persisted in AFX's JFrog environment through a malicious Groovy plugin, a trojanized gssproxy binary, and an injected shared library. Credentials recovered from internal files allowed the attacker to abuse an operations bastion and execute a downloader from 23.27.48.177 on DEX validators, which then co-signed the unauthorized bridge transaction. AFX found no evidence that the Arbitrum network or native Arbitrum bridge was compromised.