Three DeFi protocols lost $35.5 million in a day: hackers attack through keys, not code
In a single day, three DeFi protocols — AFX, B² Network, and Verus — lost a combined $35.5 million. Notably, none of the hacks were related to errors in smart contract code. Hackers have shifted tactics: instead of exploiting vulnerabilities in bridge logic, they seize control through keys and administrative rights.
The largest loss — $24 million — was incurred by the AFX protocol, deployed on the Arbitrum network. The attacker stole the bridge validator keys and withdrew funds in USDC. They then transferred the assets to Ethereum, exchanging them for 12,467.5 ETH, which they concentrated in a single address. This is a classic example of an attack at the management level, not the code level.
The second incident affected B² Network on the BNB Chain. The hacker intercepted the right to update the staking contract and stole 8.591 million B2 tokens worth approximately $3.86 million. The stolen assets were converted into over 5,000 WBNB, then into 1,128 ETH, and withdrawn via NEAR Intents. The project's native token B2 crashed by 15% immediately after the attack.
The third victim was the Verus bridge, which lost about $7.5 million. The attacker exploited a trusted bridge path — for the second time through the same vulnerability. Immediately after withdrawing the funds, the hacker began laundering them through Tornado Cash, confirming the group's high level of professionalism.
Keys Instead of Code: A New Threat
According to analyst and former NEAR core developer Vadim, all three cases reflect a paradigm shift in DeFi attacks. Previously, hackers looked for holes in smart contract logic, but with the rise in audit quality, the number of such vulnerabilities has decreased. Now, attackers focus on access control: compromising keys, administrative privileges, and contract update rights.
Statistics confirm this trend: in 2026, about 40% of all stolen cryptocurrency funds were due to key compromises, not code hacks. The main takeaway from these incidents is clear: the bridges and smart contracts themselves may be secure, but their protection collapses if an attacker gains access to management keys.
Expert opinion: This is a signal for the entire industry. Code audits are only part of the puzzle. Protocols need to implement multi-factor authentication, time locks on admin keys, and decentralized governance schemes. As long as protection is focused only on code, hackers will attack the weakest link — the human factor and access infrastructure.