Crypto news

In one day, three DeFi protocols — AFX, B² Network, and Verus — lost a total of $35.5 million. None of these hacks were related to a bug in smart contract code. This is not a coincidence, but a clear signal of a shift in attack vectors.

According to my data, the biggest blow hit the AFX protocol, which lost about $24 million in USDC on the Arbitrum network. The attacker compromised the bridge validator keys, transferred the funds to Ethereum, exchanged them for 12,467.5 ETH, and locked them on a single address. The second target was the B² bridge on BNB Chain: the hacker intercepted the rights to update the staking contract and withdrew 8.591 million B2 tokens worth approximately $3.86 million. The stolen assets were converted into 5000 WBNB, then into 1128 ETH, and withdrawn via NEAR Intents. The B2 token crashed by 15% almost instantly. The third victim was the Verus bridge, which lost about $7.5 million — the attack was carried out through the same trusted bridge path vulnerability as before. The funds immediately began to be laundered through Tornado Cash.

Keys Instead of Code: A New Era of Attacks

All three cases demonstrate a fundamentally new tactic. Previously, hackers looked for holes in smart contract logic, but today code audits have become the standard, and such vulnerabilities are becoming rarer. Instead, attackers take control of the management mechanism itself — keys, administrative rights, and contract update permissions.

The scale of the problem is confirmed by statistics: in 2026, about 40% of all stolen cryptocurrency funds came from key compromises, not code hacks. Bridges still withstand attacks at the contract level, but their defense collapses when access keys come under fire.

My conclusion: The industry overestimated code security and underestimated access management. Until DeFi protocol teams implement multi-factor key protection and rotation of administrative privileges, the wave of such attacks will only grow.