New era of cyberattacks: hackers stole $35.5 million from three DeFi bridges without breaking a single line of code
In a single day, three DeFi protocols — AFX, B² Network, and Verus — lost a combined $35.5 million. But the most notable aspect here is not the amount, but the method: none of the hacks were related to smart contract vulnerabilities. This is not an error in bridge logic; it is a compromise of control.
Three Targets, One Trend
The largest blow hit the AFX protocol, operating on Arbitrum. The attacker gained access to the bridge validator keys and withdrew approximately $24 million in USDC. The funds were instantly transferred to Ethereum and converted into 12,467.5 ETH, which settled on a single address. No complex exploits — just stolen keys.
The second incident affected B² Network on BNB Chain. The hacker took over the upgrade rights of the staking contract and stole 8.591 million B2 tokens worth roughly $3.86 million. After that, the attacker converted the assets into WBNB, then into ETH, and withdrew them via NEAR Intents. The project's native token, B2, reacted with an immediate 15% drop.
The third victim was the Verus bridge. The damage amounted to about $7.5 million. Notably, the attacker used the same vulnerability as in a previous attack on this protocol — the bridge's trusted path. Almost immediately after the theft, the funds began to be laundered through Tornado Cash.
Keys Have Become the New Target
All three cases confirm a shift in hacker tactics. Previously, the main attack vector was errors in smart contract code. Now, as the industry has begun to pay more attention to auditing and formal verification, attackers have switched to what protects that code — access keys and administrative privileges.
The scale of the problem is confirmed by statistics: in 2026, about 40% of all stolen cryptocurrency funds came from key compromises, not code hacks. Bridges still withstand attacks on logic, but their protection — access management — continues to break.
Analyst's comment: The DeFi sector is entering a new phase of maturity, where code is becoming stronger, but the human factor and key management remain the main weak link. Until Safe and multi-signatures become the standard for all cross-chain bridges, we will see such incidents again and again.