Keys, not code: three DeFi bridges lost $35.5 million in a day due to access compromise
In a single day, three DeFi protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of the attacks were related to vulnerabilities in smart contracts. The hackers operated more subtly: they seized control of keys and administrative privileges, rather than exploiting errors in the code.
Details of Each Attack
The largest blow was dealt to the AFX protocol on the Arbitrum network: attackers stole approximately $24 million in USDC using compromised bridge validator keys. The funds were transferred to Ethereum, where the hacker exchanged them for 12,467.5 ETH and concentrated them on a single address.
The second target was B² Network on the BNB Chain. The attacker intercepted the right to update the staking contract, allowing them to withdraw 8.591 million B2 tokens (~$3.86 million). The stolen assets were converted into WBNB, then into ETH, and withdrawn via NEAR Intents. The project's native token crashed by 15% immediately after the incident.
The third victim was the Verus bridge. Here, the hacker exploited a trusted bridge path, doing so for the second time through the same vulnerability. Losses amounted to approximately $7.5 million, after which the attacker began laundering the funds through Tornado Cash.
Paradigm Shift: From Bugs to Keys
As data shows, in 2026, about 40% of all stolen cryptocurrency was due to key compromises, rather than smart contract hacks. This is a logical outcome: contracts are increasingly audited, leaving fewer logic gaps. Hackers are adapting — they are moving to the access level, attacking keys, administrative panels, and contract update rights.
Expert opinion: Bridges as a technology have proven their resilience to direct code attacks. But their "Achilles' heel" is access management systems. Until the industry adopts hardware security modules (HSM) and multi-signature at the operational key level, such incidents will recur. The current situation is not a code vulnerability, but a crisis of privilege management.