An attacker stole assets from AFX's custody bridge after compromising a developer through a malicious repository shared over Telegram. The intrusion spread into AFX's JFrog environment, where a malicious Groovy plugin and modified system components maintained persistence before the attacker moved laterally to validator-related infrastructure. A remote payload downloaded from 23.27.48.177 ultimately enabled unauthorized bridge access. AFX found no evidence that the Arbitrum network or native Arbitrum bridge was compromised.