Three DeFi protocols lost $35.5 million in one day: hackers attack through keys, not through code
In a single day, three DeFi protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of the attacks were related to smart contract vulnerabilities. Instead, attackers gained control through access keys and administrative privileges.
The largest blow was dealt to the AFX protocol on Arbitrum. Losses amounted to approximately $24 million in USDC. The hacker, having gained access to the bridge validator keys, transferred the funds to Ethereum and converted them into 12,467.5 ETH, which accumulated in a single address. No code exploitation — only key compromise.
B² Network and Verus: A Continuing Trend
The second target was the B² protocol on the BNB Chain. The attacker intercepted the right to upgrade the staking contract. As a result, 8.591 million B2 tokens worth approximately $3.86 million were stolen. The hacker exchanged them for over 5,000 WBNB, then for 1,128 ETH, and withdrew the funds via NEAR Intents. The project's native token, B2, dropped by 15% immediately after the incident.
The third victim was the Verus bridge. The attacker exploited a trusted bridge path — for the second time through the same vulnerability. The Verus Ethereum bridge lost approximately $7.5 million. The attacker almost immediately began laundering the stolen funds through Tornado Cash.
A New Attack Paradigm: Keys Instead of Code
All three cases reflect a fundamental shift in hacker tactics. Previously, attacks exploited code errors, but now developers audit most contracts with AI, and logic gaps have become significantly fewer. Instead, attackers take control of the code through other means — via keys, administrative rights, and contract upgrade permissions. The focus is shifting from the vulnerability level to the access level.
The scale of the problem is confirmed by statistics: in 2026, approximately 40% of all stolen cryptocurrency was due to key compromises, not smart contract hacks. The main takeaway is that the bridges themselves withstand attacks, but their protection fails: the access keys.
Analyst's comment: The DeFi market is entering a new era where infrastructure security is not just about code auditing but also strict control over keys and privileges. Projects that ignore this aspect should prepare for a repeat of the AFX, B², and Verus scenario.