Next-generation DeFi attacks: $35.5 million stolen without a single code error
In one day, three DeFi protocols — AFX, B² Network, and Verus — lost a total of $35.5 million. But the most notable aspect is not the amount, but the method: none of these attacks were related to vulnerabilities in smart contracts. This is an alarming signal for the entire industry, pointing to a shift in attackers' tactics.
Three Strikes in One Day: Details of Each Attack
The largest blow hit the AFX protocol, operating on the Arbitrum network. Attackers stole approximately $24 million in USDC stablecoins. The cause was the compromise of bridge validator keys. The hacker instantly transferred the funds to Ethereum, exchanged them for 12,467.5 ETH, and concentrated them on a single address. This is a classic example of how code protection becomes useless if access to management is compromised.
The second victim was the B² protocol on the BNB Chain. Here, the attacker seized the rights to update the staking contract. The stolen 8.591 million B2 tokens (worth about $3.86 million) were quickly exchanged for over 5,000 WBNB, then for 1,128 ETH, and withdrawn via NEAR Intents. The project's native token B2 instantly dropped in price by 15% — a typical market reaction to such incidents.
The third was the Verus bridge. The damage amounted to about $7.5 million. The attacker exploited a trusted bridge path, and this was already the second attack on the same vulnerability. The funds were almost immediately laundered through Tornado Cash, indicating professional preparation.
Paradigm Shift: From Code to Access Control
Analysts note that all three cases reflect a global trend. Previously, hackers looked for logical errors in smart contracts. But today, code auditing has become standard, and the number of "holes" in logic has sharply decreased. Therefore, attackers have shifted their focus to the weakest link — governance.
According to independent experts, in 2026, about 40% of all stolen cryptocurrency was due to key compromise, not smart contract hacks. Bridges, as practice has shown, withstand attacks at the code level, but their protection breaks down at the access level. Keys, administrative rights, and contract update permissions are the new target.
Comment from Cryptalist analyst: This series of attacks is not a coincidence but a natural stage in the evolution of cyber threats in DeFi. Projects need to reconsider their governance models: multi-signature, time delays for critical operations, and cold storage of keys should become mandatory, not optional. Otherwise, we will see dozens more such incidents.