A new era of DeFi attacks: $35.5 million stolen without a single code error
In one day, three DeFi protocols — AFX, B² Network, and Verus — lost a total of $35.5 million. But the most alarming part of this story is not the amount, but the method. None of the attacks were related to vulnerabilities in smart contracts. The attackers did not hack the code — they seized control through keys and administrative rights.
Three strikes in one day
The largest victim was the AFX protocol on the Arbitrum network, losing about $24 million in USDC. The cause was the compromise of bridge validator keys. The hacker transferred the funds to Ethereum, exchanged them for 12,467.5 ETH, and withdrew them to a single address.
The second attack targeted the B² protocol on the BNB Chain. The attacker intercepted the rights to update the staking contract and stole 8.591 million B2 tokens worth approximately $3.86 million. After exchanging the assets for 5000 WBNB and 1128 ETH, the funds were withdrawn via NEAR Intents. The project's native token crashed by 15%.
The third target was the Verus bridge. The attack was carried out through the bridge's trusted path — for the second time using the same vulnerability. The Verus Ethereum bridge lost about $7.5 million, and the hacker immediately began laundering the funds through Tornado Cash.
Keys become the new target
This series of attacks reflects a fundamental shift in attacker tactics. Previously, hackers looked for errors in code, but today most contracts undergo strict audits, and logic gaps are becoming fewer. Instead, attackers focus on access keys, administrative rights, and contract upgrade permissions.
Statistics confirm this trend: in 2026, about 40% of all stolen cryptocurrency came from key compromises, not smart contract hacks. Bridges themselves remain resistant to attacks, but their protection — access keys — turns out to be the weak link.
My conclusion: The DeFi industry must urgently rethink its approach to key management and administrative privileges. Multi-signature, hardware wallets, and decentralized governance systems are not just recommendations but necessities. As long as protocols rely on centralized keys, they remain vulnerable to attacks that leave no traces in the code.