A new era of DeFi attacks: $35.5 million stolen without a single code error — only through keys
The DeFi market has encountered an alarming signal: in a single day, three protocols — AFX, B² Network, and Verus — collectively lost $35.5 million. Notably, none of the attacks involved exploiting errors in smart contracts. Instead, attackers focused on gaining control through access keys and administrative privileges.
Three Strikes in One Day
The largest blow hit the AFX protocol on the Arbitrum network, with losses of approximately $24 million in USDC. The attacker gained access to the bridge validator keys, transferred funds to Ethereum, and converted them into 12,467.5 ETH, which ended up in a single address.
The second victim was B² Network on the BNB Chain. The hacker intercepted the right to upgrade the staking contract and stole 8.591 million B2 tokens worth about $3.86 million. The assets were exchanged for over 5,000 WBNB, then into 1,128 ETH, and withdrawn via NEAR Intents. Following the attack, the native B2 token lost 15% of its value.
The third was the Verus bridge. The attack was carried out through a trusted bridge path — and this is already the second time the same vulnerability has been exploited. The Verus Ethereum bridge lost approximately $7.5 million, and the attacker immediately began laundering the funds through Tornado Cash.
Keys — The New Weak Link
All three cases demonstrate a fundamental shift in hacker tactics. Previously, the main attack vector was code errors that were found and exploited. Today, as most contracts undergo thorough audits, logic gaps are becoming fewer. Attackers have switched to a different level — they are attacking not the code, but access to it.
Compromised validator keys, hijacking contract upgrade rights, exploiting trusted paths — all of this indicates that the weak point is not the bridges themselves, but their protection. According to analysts, in 2026, about 40% of all stolen cryptocurrency was due to key compromises, not smart contract hacks.
Expert opinion: This trend requires a reassessment of security approaches. Protocols must implement multi-factor authentication for administrative actions and regularly rotate keys. Otherwise, as practice shows, even the most perfect code will not help if the keys to it are left under the doormat.