Woofun AI reports that the cross-chain bridge of AFX, a decentralized perpetual contract exchange, was compromised by hackers, prompting immediate coordination with security firms, ecosystem partners, exchanges, and relevant authorities to monitor fund flows and support the investigation.

The magnitude of the theft is starkly illustrated by Defillama data, which indicates that the $24 million stolen represents the entire Total Value Locked (TVL) of the protocol, effectively emptying the system in a single event.

The timeline of the incident reveals a rapid escalation from launch to collapse; AFX officially launched its mainnet in May, followed by the release of its audit report on June 3, just days before the breach, leading professional security experts to scrutinize the document’s adequacy.

Zellic, the auditing firm, identified 11 issues in total, including two critical and six moderate impact findings, but explicitly noted that their review covered only a portion of the components, lacking testing of all security-critical paths in a real-time or local environment, relying instead on static reviews.

A more critical variable is the scope limitation regarding asset flow and verification; Zellic disclosed that they could not verify the complete asset cross-chain process, including asset custody, signature verification, and permission control, and warned that even if vulnerability fixes were implemented, they could not confirm correctness or guarantee that new vulnerabilities were not introduced, rendering the report akin to a phase check result rather than a comprehensive security proof.

Woofun AI data shows that Taylor Monahan, Chief Product Manager at MetaMask and founder of MyEtherWallet and MyCrypto, characterized the audit report as "terrifying," citing numerous "confirmed" issues that remained unaddressed, and expressed disbelief that users would deposit over $24 million into a protocol with such glaring gaps.

Monahan further speculated that the system was not a 'completely true M of N system,' pointing to unhandled edge cases and the manual operation of user funds as evidence of poor design, suggesting that validators and keys might be controlled by a single individual or hosted on the same system, thereby relying entirely on team intervention to prevent theft.

Investigation into the team’s background reveals strong ties to Phemex, which is suspected to be the parent company; AFX’s growth director Ken previously listed himself as 'Head of Listing @phemex_official' on his X profile, a core position at any exchange, while another team member, Damon, followed at least three team members from Phemex on X.

Promotional activities further cement this connection; Phemex’s official blog published articles such as 'Unlock Your Strength: Discover Why AFX Protocol Transforms Lives,' 'The Philosophy of Anti-Fragility: Why AFX Protocol Matters,' 'Dive into the Multi-Asset Perps Revolution!,' and 'Top 5 Perpetual DEXs to Watch in 2026,' where AFX was ranked ahead of competitors like Hyperliquid, although these posts have since been deleted, links remain visible in Google search results.

Branding similarities also suggest a shared origin; both projects utilize logos with a gradient color scheme transitioning from fluorescent green to teal against a pure black background, creating a nearly identical visual atmosphere and tonal orientation that may indicate a shared design team.

The historical context of Phemex adds a layer of complexity; in January 2025, Phemex was hacked for $70 million, an incident attributed to North Korean hackers, during which the platform stated that user assets were unaffected, the platform would bear the losses, and normal withdrawal processes were quickly restored.

Despite Phemex’s apparent preparation for risk isolation during AFX’s launch, with no public connections on branding, stocks, or other levels, the intricate relationship between the two entities cannot be concealed, raising questions about whether the current breach is a repeat of North Korean hackers' tactics or an insider's scheme to harvest tens of millions of dollars, a question that remains to be answered by further evidence and analysis.