Offchain CEO details bridge risk management strategies after $24M Arbitrum exploit

A $24.15 million exploit on a third-party bridge operating on Arbitrum has turned into a very public lesson about which bridges you should trust with your crypto. Steven Goldfeder, CEO and co-founder of Offchain Labs, used the incident to outline exactly how his team thinks about bridge risk management, and why the native Arbitrum bridge sits in a fundamentally different security category.

The breach hit AFX Trade on July 22, when attackers compromised validator keys on the bridge protocol and drained approximately $24.15 million in USDC. The stolen funds were subsequently swapped for roughly 12,467 ETH. Goldfeder confirmed the exploit originated entirely from a third-party protocol and that Arbitrum’s native bridge remained secure throughout the incident.

Native vs. third-party: a distinction that matters

Arbitrum’s native bridge inherits its security directly from the rollup’s architecture, secured by the same mechanism that protects the entire Arbitrum network, which ultimately relies on Ethereum’s own security guarantees. Third-party bridges like AFX Trade operate independently, introducing their own trust assumptions, key management practices, and validator sets.

Goldfeder, who holds a Ph.D. in applied cryptography from Princeton University, emphasized that Offchain Labs has improved bridge security through a combination of technical measures and user education. The company also conducts due diligence on third-party bridges that operate within the Arbitrum ecosystem, though the AFX Trade incident demonstrates the limits of oversight when external protocols manage their own security infrastructure.

The exploit and its aftermath

The AFX Trade attack followed a depressingly familiar playbook. Compromised validator keys gave attackers the ability to authorize fraudulent withdrawals, a vulnerability pattern that has plagued cross-chain bridges since the earliest days of multi-chain DeFi. Once the keys were compromised, the attackers moved quickly, draining USDC before converting to ETH to obscure the trail.

AFX Trade proposed a white-hat bounty deal to the attacker: return 70% of the stolen funds and keep the rest as a bug bounty. The incident was far from isolated. July 2026 has seen at least 14 recorded security breaches across the crypto sector.

What this means for investors

Bridge selection matters. Users moving assets between Ethereum and Arbitrum face a real choice between the native bridge, which benefits from rollup-level security guarantees, and third-party options that offer speed or convenience but introduce additional risk vectors.

Offchain Labs’ stated approach of conducting due diligence on third-party bridges positions Arbitrum as a network that at least attempts to curate its infrastructure partners, even if that curation clearly has limits. A steady drumbeat of bridge exploits — 14 in a single month — gives regulators ammunition to impose stricter guidelines on bridging technology and cross-chain protocols.