A new era of DeFi attacks: hackers stole $35.5 million without touching a single line of code
In a single day, three DeFi protocols lost a combined total of $35.5 million. And none of these attacks were related to errors in smart contract code. We are witnessing a paradigm shift: hackers are no longer hunting for logic vulnerabilities — they are seizing control of protocols through keys and administrative rights.
The victims were the AFX, B² Network, and Verus projects. Each incident showed that the weak link was not the bridges themselves, but the keys that protect them. This is a fundamentally new threat vector that requires the industry to rethink its approach to security.
Three strikes in one day
The largest loss was suffered by the AFX protocol on the Arbitrum network — approximately $24 million. The cause was stolen bridge validator keys. The attacker transferred the stolen funds from Arbitrum to Ethereum and exchanged them for 12,467.5 ETH, which ended up in a single address.
The second attack targeted the B² protocol on the BNB Chain. The hacker intercepted the right to upgrade the staking contract. The project lost 8.591 million B2 tokens worth approximately $3.86 million. The attackers exchanged the stolen assets for over 5,000 WBNB, then for 1,128 ETH, and withdrew them via NEAR Intents. The project's native token B2 instantly dropped by 15%.
The third victim was the Verus bridge. The attacker exploited a trusted bridge path, and for the second time through the same vulnerability. The Verus Ethereum bridge lost approximately $7.5 million. The attacker almost immediately began laundering the stolen funds through Tornado Cash.
Keys — the new battlefield
All three cases reflect a shift in hackers' approach to attacks. Previously, errors in the code itself were exploited, but now developers audit most contracts with AI, and logic loopholes have become fewer.
Therefore, attackers take control of the code through other means — via keys, administrative rights, and contract upgrade permissions. The focus of attacks is shifting from the vulnerability level to the access level.
The scale of the problem is confirmed by statistics: in 2026, approximately 40% of stolen cryptocurrency was due to key compromises, not smart contract hacks. The main takeaway: the bridges themselves withstand attacks, but their protection — access keys — fails.
Expert opinion: The industry has invested enormous resources in code security but has forgotten the most basic element — key management. Until DeFi projects implement multi-factor authentication, multi-signature, and hardware security modules (HSM) for critical operations, we will see such incidents again and again. This is a systemic problem, not a series of coincidences.