New era of cyberattacks: three DeFi protocols lost $35.5 million due to key compromise, not code
In a single day, three DeFi protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of these attacks were related to smart contract vulnerabilities. According to data from an analyst and former NEAR core developer, hackers have shifted to a fundamentally new tactic: seizing control through keys and administrative rights.
Three Strikes in 24 Hours
The largest loss was suffered by the AFX protocol, which lost approximately $24 million in USDC on the Arbitrum network. The attacker gained control of the bridge validator keys, transferred the funds to Ethereum, and converted them into 12,467.5 ETH, which ended up in a single address.
The second target was the B² protocol on BNB Chain. The hacker intercepted the right to update the staking contract and stole 8.591 million B2 tokens worth about $3.86 million. Afterward, the stolen assets were exchanged for over 5,000 WBNB, then into 1,128 ETH, and withdrawn via NEAR Intents. The project's native token, B2, instantly lost 15% of its value.
The third victim was the Verus bridge. The attacker exploited a trusted bridge path, marking the second time the same vulnerability has been exploited. The Verus Ethereum bridge lost approximately $7.5 million. Almost immediately after the theft, the hacker began laundering the funds through Tornado Cash.
Keys — The New Weak Link
All three incidents point to a paradigm shift in cyberattacks on DeFi. Previously, hackers exploited code errors, but today most contracts undergo rigorous audits, and logical "holes" have become significantly fewer. Now, attackers take control of the code through other means — via keys, administrative rights, and contract upgrade permissions. The focus is shifting from vulnerabilities to the access level.
The scale of the problem is confirmed by statistics: in 2026, about 40% of all stolen cryptocurrency was due to key compromises, not smart contract hacks. The bridges themselves withstand attacks, but their defense — access keys — breaks down.
Expert opinion: This trend is a warning sign for the entire industry. Projects invest millions in code audits but forget about the most vulnerable element — the human factor and key management. Until multi-signature wallets and access management systems become the security standard, we will see more and more of these "code-less" hacks.