AFI Protocol was hit by a security breach that drained about $480,000 from its afiUSD vault on Ethereum on May 30, 2026. The attack targeted the protocol’s yield-bearing stablecoin product. In response, AFI paused the affected vault, launched an investigation, and worked with security partners on recovery efforts. The protocol said its remaining systems are secure, along with more than $225 million in total value locked.
In an official security incident update on X, the team said the attacker converted roughly $252,000 in DAI into ETH through on-chain swaps. It added that about 150 ETH was later sent to Tornado Cash after the attacker tested a secondary wallet with a small transfer. AFI said, “We are working with Quantstamp, Cantina, and SEAL 911 to trace and recover stolen funds.”
AFI moves quickly to contain damage
The protocol responded immediately after detecting the exploit, pausing the affected vault and rotating operational keys across the platform. AFI also reviewed its remaining vaults and core systems.
The company said investigators found no evidence of further compromise. It flagged attacker addresses with centralized exchanges and ecosystem partners through SEAL 911 in an effort to restrict movement of the stolen funds while tracing them. AFI also launched a bounty program, offering a reward for information that could help recover the stolen assets.
AFI still holds a large amount of assets locked in its protocol. Data from DeFiLlama puts the figure at about $225.32 million in total value locked. The platform expanded quickly earlier in the year, with deposits rising sharply in March before leveling off above the $200 million mark. Compared with that scale, the recent exploit accounts for only a small portion of the protocol’s liquidity.
Financial metrics show limited revenue generation. AFI reports annualized revenue of roughly $130,285, compared with annualized fees of about $264,993.
DeFi security concerns continue rising
The AFI exploit comes amid a series of recent security incidents across decentralized finance projects. Syscoin recently halted bridge operations after attackers exploited a validation flaw that led to the creation of billions of unauthorized SYS tokens.
The BY token project on Binance Smart Chain also reported losses of about $88,400. Stake DAO separately said an attacker minted more than 5.4 trillion vsdCRV tokens on Arbitrum during a breach.
AFI has said its focus remains on recovering stolen funds and maintaining transparency as investigations continue.
Also Read: ZachXBT Calls $32M Humanity Protocol Hack ‘Possibly Staged,’ $H Crashes 86%
