Keys, not code: Hackers stole $35.5 million from three DeFi protocols in one day
Over the past 24 hours, three DeFi protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of the attacks involved exploiting errors in smart contracts. Hackers focused on seizing administrative control and compromising access keys, rather than breaking the code.
The largest blow hit the AFX protocol on Arbitrum. According to my data, attackers stole about $24 million in USDC, transferring the funds to Ethereum and exchanging them for 12,467.5 ETH. The cause was the theft of bridge validator keys. This is a classic example of how an infrastructure vulnerability, rather than a logical error, leads to catastrophic losses.
The second incident affected B² Network on BNB Chain. The hacker intercepted the right to update the staking contract and withdrew 8.591 million B2 tokens worth approximately $3.86 million. The stolen assets were converted into 5,000 WBNB, then into 1,128 ETH, and laundered through NEAR Intents. The market reacted instantly: the native B2 token crashed by 15%.
The third victim was the Verus bridge. The attacker reused the same vulnerability as in the previous attack — the bridge's trusted path. The damage amounted to about $7.5 million. The hacker immediately began laundering through Tornado Cash, confirming a high level of professionalism.
New Paradigm of Threats: From Code to Control
As I have repeatedly noted, the DeFi market is undergoing a fundamental transformation in attack vectors. Previously, hackers hunted for errors in smart contracts, but today code auditing has become the standard, and "holes" in logic have significantly decreased. Now, attackers target not the code but the management system: keys, administrative rights, and contract update permissions.
Statistics confirm this trend: in 2026, about 40% of all stolen cryptocurrency funds came from key compromises, not smart contract hacks. Bridges themselves remain resistant to direct attacks, but their protection — access keys — becomes the weak link.
My conclusion: The industry must urgently reconsider approaches to privilege management. Multi-signatures, hardware security modules, and strict key rotation procedures are not just "best practices" but a necessity. Ignoring this risk will lead to new multi-million dollar losses, with the code remaining untouched. We stand on the threshold of an era where DeFi security is determined not by the quality of contracts, but by the quality of access management.