Woofun AI reports that the perpetrator behind the AFX Trader breach utilized THORChain to obscure stolen assets, a move tracked by blockchain analyst EmberCN.

The incident originated on July 23, when AFX Trader, an Arbitrum-based decentralized finance protocol, suffered a $24.15 million loss of USDC through a bridge hack. The attacker immediately converted the stolen stablecoins into 12,467.4 ETH, a standard maneuver designed to complicate forensic tracking and evade stablecoin blacklisting mechanisms.

Structurally, the hacker leveraged THORChain’s native cross-chain swaps to move 655.4 ETH into 18.86 BTC. This protocol facilitates transfers without wrapping assets or relying on centralized intermediaries, thereby creating significant obstacles for investigators attempting to trace or freeze the illicit funds.

Per Woofun AI, AFX Trader initiated a white-hat negotiation, proposing that the attacker retain 30% of the stolen funds—approximately $7.24 million—as a bounty. In exchange, the hacker would be required to return the remaining 70% of the assets to the protocol, a strategy aimed at mitigating total loss and avoiding further legal escalation.

This event underscores persistent vulnerabilities in bridge liquidity pools and the inherent tension between decentralization and security. As bridge exploits remain among the most costly attack vectors, the industry must prioritize rigorous security audits to address these critical risks.