$35.5 million stolen in one day: hackers shift from code to keys in DeFi
In a single day, three DeFi protocols lost a total of $35.5 million — and none of these attacks were related to a smart contract bug. This is not a coincidence, but a clear signal of a shift in the threat vector within the crypto industry.
The affected projects are AFX, B² Network, and Verus. As the data shows, in all three cases, the weak link was not the bridges, but the access keys that protect them.
Three attacks in 24 hours
The largest blow hit the AFX protocol, operating on the Arbitrum network. Hackers stole the bridge validator keys and withdrew approximately $24 million in USDC. The attacker moved the funds to Ethereum, exchanged them for 12,467.5 ETH, and concentrated them on a single address.
The second victim was the B² protocol on the BNB Chain. The attacker intercepted the right to upgrade the staking contract, allowing them to withdraw 8.591 million B2 tokens worth approximately $3.86 million. After the hack, the project's native token crashed by 15%. The hacker exchanged the stolen assets for over 5,000 WBNB, then for 1,128 ETH, and withdrew them via NEAR Intents.
The third target was the Verus bridge. The attacker used a trusted bridge path, and did so for the second time — through the same vulnerability. The Verus Ethereum bridge lost approximately $7.5 million. Almost immediately, the hacker began laundering the stolen funds through Tornado Cash.
Why code is no longer the main target
All three cases reflect a fundamental shift in hacker tactics. Previously, attacks exploited bugs in the code itself, but today developers audit most contracts with AI, and logic "holes" have become significantly fewer.
Attackers take control of the code through other means — via keys, administrative rights, and contract upgrade permissions. The focus is shifting from the vulnerability level to the access level. According to statistics, in 2026, approximately 40% of all stolen cryptocurrency will come from key compromises, rather than smart contract hacks.
The main conclusion is simple: the bridges themselves withstand attacks, but their protection — the access keys — breaks. This means that DeFi security today hinges not on code, but on privilege management.
Expert opinion: While the community focuses on smart contract audits, hackers have already found an easier target. Projects urgently need to implement multi-signature schemes and hardware security modules (HSM) to protect keys — otherwise, we will see these attacks repeated on an even larger scale.