AFX's bizarre theft case: the audit report is riddled with flaws, and the company behind it is suspected to be the cryptocurrency exchange Phemex

Author: Gu Yu, ChainCatcher

Today, the cross-chain bridge of the decentralized perpetual contract exchange AFX was hacked, resulting in the theft of over $24 million in assets. According to the TVL displayed by Defillama, this amount is equivalent to the entire protocol being drained.

After the incident, AFX posted on X stating that it is working closely with leading security firms, ecosystem partners, exchanges, and relevant authorities to monitor the flow of funds and support the ongoing investigation.

1. Audit Report Full of Holes

However, AFX's painful lesson seems to have had early warning signs. The project officially launched its mainnet in May and released its audit report on June 3. After today's theft incident, several professional security experts found significant issues with this report.

In the report, the security audit firm Zellic stated that it discovered 11 issues, including two critical issues, one of which has a high impact and six of moderate impact.

"Given that this audit only covered a portion of the components that make up the bridge protocol and lacked testing coverage of all security-critical paths, this is particularly important. This not only limits our ability to verify correctness but also restricts AFX's future security maintenance capabilities. Additionally, a key factor that urgently needs re-auditing is that we did not have the capability to run or interact in real-time or local environments at that time. This greatly limited our ability to verify functionality, explore edge cases, and assess system behavior beyond static reviews," Zellic wrote in the summary section.

According to Zellic's disclosure, the code it could access and verify only covered part of the bridge protocol's components, failing to encompass the complete asset cross-chain process, nor could it be tested in a real operating environment. This means that for the core asset custody, signature verification, permission control, and other critical paths of the cross-chain bridge, the auditing agency could not provide a complete conclusion.

Zellic also specifically warned that even if the project team completes vulnerability fixes based on the report, the auditing agency cannot confirm whether these fixes were implemented correctly, nor can it guarantee that new vulnerabilities will not be introduced during the fixing process. This means that the report cannot actually serve as proof that the bridge protocol is "safe," but rather resembles a phased inspection result for part of the code.

For a cross-chain bridge managing tens of millions of dollars in assets, "incomplete audit scope" itself is a risk. When the auditing agency cannot confirm the security boundaries of the entire system, users also find it difficult to assess the true security of the protocol.

In response, Taylor Monahan, Chief Product Manager at MetaMask and founder of MyEtherWallet and MyCrypto, tweeted that the AFX cross-chain bridge audit report is "terrifying," noting that many "confirmed" issues were not fixed, and expressed extreme confusion over users transferring over $24 million into the protocol.

"This audit strongly points to a team that fundamentally does not care about being responsible for an 'incomplete true M of N system.' Unhandled edge cases? No problem. Manually operating user funds? No problem. Completely relying on team intervention to prevent being robbed? No problem."

Taylor Monahan speculated that it is highly likely that all validators and keys are on the same system or controlled by a single person.

2. Parent Company Suspected to be Phemex

ChainCatcher reporters further investigated the AFX team and found that the project seems to have a close connection with the cryptocurrency exchange Phemex, and Phemex is likely its parent company.

The intricate connections among team members are one piece of supporting evidence. AFX's growth director Ken's X account previously described him as "Head of Listing @phemex_official," which is the listing manager at Phemex, one of the core functional positions at any exchange.

Another team member followed by AFX's official X account, Damon, although there is no more public information about him, created his X account four months ago and followed at least three team members from Phemex after following the AFX account.

Additionally, Phemex's official blog has published several articles promoting AFX, such as "Unlock Your Strength: Discover Why AFX Protocol Transforms Lives," "The Philosophy of Anti-Fragility: Why AFX Protocol Matters," "Dive into the Multi-Asset Perps Revolution!" and "Top 5 Perpetual DEXs to Watch in 2026," with AFX being prominently featured ahead of other Perp DEXs like Hyperliquid in the last article.

Currently, the aforementioned articles have been removed from Phemex's official website, but links to these articles still appear in search results when searching for their titles on Google.

Another piece of associative evidence is that the logos of the two projects have very similar thematic styles, both using a gradient color scheme from fluorescent green to teal against a pure black background, with nearly identical visual atmosphere and tonal orientation, which may also reflect that they share the same design team.

Considering the team's background, official historical promotions, brand design, and public operational traces, there appears to be a connection between AFX and Phemex that goes far beyond ordinary ecosystem partnerships.

The most "chilling" question is that the Phemex exchange was also hacked for over $70 million in January 2025, with external analysis suggesting it was likely the work of North Korean hackers. At that time, the Phemex team stated that user assets would not be affected, and the platform would bear the losses caused by the incident, quickly restoring normal withdrawal processes.

During the launch of the AFX product, Phemex clearly prepared for risk isolation in advance, with no public connections between the two on branding, stocks, and other levels, yet the intricate relationship between them cannot be concealed.

Now, the tragedy of losing tens of millions of dollars has replayed. Whether this is a repeat of North Korean hackers' tactics or an insider orchestrating a scheme remains to be seen, relying on more evidence and analysis.