Axelar Cross-Chain Bridge Exploit Drains $4.67 Million

Cross-chain bridges allow users to move assets between otherwise separate blockchains, typically by locking tokens on one network and releasing corresponding assets on another. The bridge connecting XRP Ledger and Coreum, now known as tx, relied on software to verify incoming deposits before permitting withdrawals. A failure in that verification process exposed its reserves, underscoring the persistent security risks surrounding infrastructure that links blockchain networks.

An attacker exploited the flaw by submitting fake deposits that the software accepted as genuine, then withdrew about 200,000 XRP from the bridge’s reserves, causing losses of roughly $200,000. As of Aug. 14, 2026, the operator had suspended the bridge and patched the vulnerability. It also hired blockchain forensics specialists to trace the funds and investigate the breach, and formally reported the incident to the U.S. Federal Bureau of Investigation.

AFX Trade, also known as AFX Protocol, is a decentralized perpetual-futures exchange on Ethereum layer-2 network Arbitrum, with trades settled in USDC. The incident matters because cross-chain bridges concentrate assets behind validator or multisignature controls, making compromised signing keys a direct route to custodial funds. The breach was confined to infrastructure operated by AFX, underscoring the distinction between an application-layer failure and the security of Arbitrum itself.

Blockaid said it detected the exploit at 9:30 p.m. UTC on July 22, 2026. The attacker withdrew 24.15 million USDC through AFX’s custody bridge, moved the funds to Ethereum and exchanged them for about 12,467 ETH at an average price of $1,937, according to on-chain trackers. AFX suspended bridge operations and offered a 30% white-hat bounty for returning the remaining 70%. Offchain Labs co-founder Steven Goldfeder said Arbitrum’s native bridge was neither hacked nor exploited.

Allbridge Core is a cross-chain bridge designed to move stablecoins between blockchains including Solana and Ethereum. Such protocols pool liquidity and coordinate transfers across otherwise separate networks, making them important infrastructure for decentralized finance. Their concentration of assets and reliance on smart-contract pricing also make them frequent targets, with any failure potentially exposing liquidity providers and disrupting users’ ability to move funds between chains.

On July 19, an attacker borrowed $1.12 million through a flash loan from Solana-based lending protocol Kamino and rapidly swapped USDC for USDT to distort Allbridge Core’s pool ratios, according to Onchain Lens. The maneuver enabled withdrawals at favorable rates and drained about $1.65 million. Allbridge paused the protocol and urged users to remove liquidity from affected pools. PeckShield and CertiK said the stolen assets were later bridged from Solana to Ethereum and deposited into privacy pools.