$35.5 million in one day: three DeFi protocols fell victim to an attack on access keys, not code
In the past 24 hours, three DeFi protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of these incidents were related to vulnerabilities in smart contracts. The attackers operated under a new scheme: instead of searching for bugs in the code, they seized control of administrative keys and management rights.
Biggest Blow to AFX
The most significant damage was suffered by the AFX protocol on the Arbitrum network — approximately $24 million in USDC. The attacker stole the bridge validator keys, transferred the funds to Ethereum, and converted them into 12,467.5 ETH, which ended up in a single address. This is a classic example of an attack at the access level, not at the contract logic level.
B² Network and Verus: Repeating the Pattern
The second target was the B² bridge on the BNB Chain. The hacker intercepted the right to update the staking contract and withdrew 8.591 million B2 tokens worth about $3.86 million. The stolen assets were exchanged for 5,000 WBNB, then for 1,128 ETH, and withdrawn via NEAR Intents. The project's native token B2 immediately dropped by 15%.
The third victim was the Verus Ethereum bridge, which lost approximately $7.5 million. The attacker used the bridge's trusted path — for the second time through the same vulnerability. The funds were almost immediately sent for laundering via Tornado Cash.
Paradigm Shift: Code is Safe, Keys Are Not
Analysis of these three incidents confirms a worrying trend: hackers are shifting focus from code exploits to access compromise. In 2026, about 40% of all stolen funds in cryptocurrency came from key theft, not smart contract hacks. The bridges and protocols themselves may be flawless in terms of code, but their protection collapses if an attacker gains control over keys or administrative privileges.
Expert Commentary: The DeFi market is undergoing a painful transition from the "find a bug" era to the "steal a key" era. Projects need to rethink their access management models: multi-signatures, time delays, and hardware security modules should become the standard, not an option. Ignoring this lesson will cost the industry hundreds of millions more dollars.