Keys, Not Code: How Hackers Stole $35.5 Million from Three DeFi Protocols in One Day
Over the past 24 hours, the crypto community has witnessed an unusual series of attacks: three DeFi protocols — AFX, B² Network, and Verus — lost a total of $35.5 million, and none of these hacks were related to errors in smart contract code. This is an alarming signal indicating a shift in attackers' tactics.
Incident Details
AFX (Arbitrum): The largest loss amounted to approximately $24 million in USDC. The hacker gained access to the bridge validator keys, transferred the funds to Ethereum, and converted them into 12,467.5 ETH, which are currently held at a single address.
B² Network (BNB Chain): The protocol lost 8.591 million B2 tokens worth approximately $3.86 million. The attacker seized the upgrade rights to the staking contract, swapped the stolen assets for WBNB and ETH, and then withdrew them via NEAR Intents. The project's native token B2 instantly dropped by 15%.
Verus (Ethereum): The bridge lost about $7.5 million. The attacker exploited the bridge's trusted path, marking the second time the same vulnerability has been exploited. The funds were almost immediately sent to Tornado Cash for laundering.
New Attack Vector: Access Control
Analysts note that all three cases share a common thread: the weak link was not the smart contracts themselves, but keys and administrative privileges. Hackers are no longer spending time searching for code vulnerabilities — they seize control through compromised validator keys, contract upgrade rights, and trusted bridge paths.
According to data, in 2026, approximately 40% of all stolen cryptocurrency funds were attributed to key compromises rather than smart contract hacks. Bridges, as practice has shown, withstand code-based attacks, but their defense breaks down precisely at the access level.
Expert Comment: The DeFi market is experiencing a fundamental shift in threats. Project teams need to reconsider their priorities: instead of focusing solely on smart contract audits, it is critically important to implement multi-factor authentication, multi-signature wallets, and strict key management procedures. Otherwise, we will see even more such incidents where the code is flawless, but security is an illusion.