$35.5 million per day: hackers attack DeFi bridges through keys, not code
In a single day, three DeFi protocols lost a total of $35.5 million. Notably, none of the attacks were related to errors in smart contract code. As my analysis shows, attackers are increasingly seizing control of protocols through keys and administrative rights, rather than through vulnerabilities in bridge logic.
The victims were the AFX, B² Network, and Verus projects. In each case, the weak link was not the bridges themselves, but the keys that protect them. This is an alarming signal for the entire industry, where the security of access infrastructure often takes a back seat to code auditing.
Three Hacks in One Day
The largest loss was suffered by the AFX protocol — approximately $24 million. The cause was the theft of bridge validator keys. As confirmed by data from analysts at PeckShield, AFX on the Arbitrum network lost roughly $24 million in USDC. The attacker transferred the stolen funds from Arbitrum to Ethereum and exchanged them for 12,467.5 ETH, which ended up in a single address.
The second attack was the hack of the B² protocol. The hacker intercepted the right to update the staking contract. According to experts, B² on the BNB Chain lost 8.591 million B2 tokens worth about $3.86 million. The attackers exchanged the stolen assets for more than 5,000 WBNB, then for 1,128 ETH, and withdrew them via NEAR Intents. The project's native token, B2, quickly dropped in value by 15%.
The third victim was the Verus bridge. The attacker exploited a trusted bridge path, doing so for the second time through the same vulnerability. As confirmed by PeckShield, the Verus Ethereum bridge lost approximately $7.5 million. The attacker almost immediately began laundering the stolen funds through Tornado Cash.
Keys Instead of Code
All three cases reflect a shift in hackers' approach to attacks. Previously, they exploited errors in the code itself, but now developers are auditing most contracts with AI-based tools, and logic loopholes have become fewer.
Therefore, attackers are taking control of the code through other means — via keys, administrative rights, and contract update permissions. The focus of attacks is shifting from the vulnerability level to the access level.
The scale of the problem is confirmed by statistics: in 2026, about 40% of stolen cryptocurrency came from key compromises, rather than smart contract hacks. The main conclusion is obvious: the bridges themselves withstand attacks, but their protection — the access keys — fails.
Expert opinion: The DeFi market is experiencing a fundamental shift in the threat vector. Code auditing is no longer a panacea. Project teams need to implement multi-layered key management systems, including multi-signature and hardware security modules (HSMs), otherwise we risk seeing similar incidents on an even larger scale.