A new era of DeFi attacks: $35.5 million stolen without a single code error — key capture, not smart contracts
In a single day, three DeFi protocols — AFX, B² Network, and Verus — lost a total of $35.5 million. The key feature of these incidents, which forces a reassessment of security approaches in the industry, is that none of the attacks were related to vulnerabilities in smart contract code. Hackers are no longer looking for logic errors; they are seizing control through administrative keys and access rights.
Attack Details: From Bridges to Governance
The largest loss was suffered by the AFX protocol on the Arbitrum network — approximately $24 million in USDC. The cause was the compromise of bridge validator keys. The attacker quickly moved the assets to Ethereum, converting them into 12,467.5 ETH, which are now concentrated at a single address.
The second target was the B² protocol on the BNB Chain. The hacker intercepted the right to update the staking contract and withdrew 8.591 million B2 tokens worth about $3.86 million. The stolen assets were exchanged for 5,000 WBNB, then for 1,128 ETH, and withdrawn via NEAR Intents. The project's native token B2 instantly dropped by 15%.
The third victim was the Verus bridge on Ethereum, which lost approximately $7.5 million. Notably, the attack was carried out through the bridge's trusted path — and this is already the second time the same vulnerability has been exploited. The hacker almost immediately began laundering the funds through Tornado Cash.
Paradigm Shift: Code is Secure, Keys are Not
The scale of the problem is confirmed by statistics: in 2026, about 40% of all stolen cryptocurrency funds were due to key compromises, not smart contract hacks. This reflects a fundamental shift in attacker tactics. Previously, attacks exploited logical errors in code, but now, when most contracts undergo AI audits, such loopholes are becoming rarer. Hackers take control of code through other means — via keys, administrative rights, and update permissions.
My analysis: This trend is an alarming signal for the entire DeFi ecosystem. Bridges and protocols themselves are becoming increasingly resistant to direct attacks, but their protection, built on centralized keys, remains an Achilles' heel. The industry urgently needs to transition to decentralized governance models and multi-signature schemes with strict time delays. Ignoring this threat will make DeFi vulnerable not to code errors, but to the human factor and operational security.