Compromise of AFX Trade's off-chain validator signing system allowed five signatures to authorize a fraudulent withdrawal of approximately $24.15 million in USDC from its Arbitrum bridge on July 22, 2026. The attacker bridged the assets to Ethereum, converted them through UniswapX into 12,467.43703738 ETH, and later fragmented the funds across roughly two dozen addresses. zeroShadow and SEAL assessed a highly likely link to North Korean group UNC4899, citing a gas-funding pattern similar to the earlier KelpDAO exploit, but the attribution remained preliminary. The incident exploited trusted signing authority rather than a defect in the bridge contract.