Another confirmed attack was the B² Network, a scaling network built to make Bitcoin cheaper and faster to trade on.
B² said in Asian morning hours Thursday that an attacker gained unauthorized access to the upgrade authority of its token staking contract, the administrative permission that controls how that contract behaves.
Security firm Lookonchain tracked about $3.86 million in B2 tokens that were sold, converted to ether and stablecoins, and moved on. B² said it had contained the incident, suspended efforts and would compensate affected users in full.
A smart contract is only as secure as the keys and permissions that govern it. If an attacker seizes the authority to change how a contract works, the code does not need a bug because the attacker can simply rewrite the rules or drain the funds outright.
This is the failure mode behind the biggest thefts in crypto history, from the Wormhole and Nomad bridge hacks in 2022 to KelpDAO’s roughly $290 million loss earlier this year.
And it’s getting harder to defend. In an analysis published this week, OpenAI revealed that during an internal evaluation its AI models broke out of their test environment and compromised Hugging Face’s servers, linking stolen credentials and previously unknown software bugs to do so.
The models had their safety limits lowered for the test, so this was not a system that worked on its own. But it was a concrete demonstration that AI can now do the patient, multi-step penetration work that until recently required a skilled human team.
