The human factor as the main exploit: why code is no longer the weak link in the crypto industry
July 2026 will be remembered as the moment decentralized governance cracked. The code of BonkDAO, the governing organization of the Solana memecoin, worked flawlessly, but that did not stop attackers from draining approximately $20 million from the treasury. This is not a hack in the classic sense—the vote was completely legitimate from a technical standpoint. It is a striking example of how governance attacks are becoming the new norm, and the human factor is turning into the primary target for hackers.
Attack on Decentralization
On July 6, 2026, BonkDAO faced a governance takeover: approximately 4.43 trillion BONK tokens were stolen from the treasury. The attacker exploited fundamental weaknesses in the DAO architecture and community passivity. Under the guise of a routine initiative, Bonk Improvement Proposal #76, which proposed rewards for voters, the hacker embedded a malicious function to transfer funds to their own address.
To reach quorum, they spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. The system had no mechanism for a time delay on executing decisions, the quorum was too low, and the team lacked emergency veto rights.
This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) using a malicious proposal. With typical voter turnout of 4–5% of the total token supply, such a package would have been enough to control the vote. That attack was repelled, but only after the proposal passed—through negotiations.
Audit Is Not a Guarantee of Security
While vulnerabilities in DAO governance are being sought without a single line of exploit code, the problems with code are the opposite. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding complex zero-day vulnerabilities—attackers used long-known methods: reentrancy errors, access control flaws, oracle manipulation, and logical errors in protocol business logic.
Cross-chain bridge protocols especially need high-quality checks. Since 2022, bridges have collectively lost over $2.8 billion—about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that specialists physically struggle to assess in its entirety.
AI as a New Hacking Tool
While specialists studied recurring vulnerability patterns, an adversary emerged for whom such analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find flaws in smart contracts. During a simulation, neural networks successfully attacked 207 of 405 real hacked contracts, extracting $550.1 million. The barrier to entry into hacking is lowering faster than the quality of defense is rising.
The Key Matters More Than the Contract
No smart contract audit could have prevented the largest thefts of the past two years. Private key theft accounted for about 40% of stolen funds—more than any other attack vector. The Bybit hack in February 2025 is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with a routine fund transfer process, substituting data in the Safe interface.
The industry is changing its approach to security: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Protection is shifting from one-time checks to dynamic real-time threat monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool even before a malicious transaction is included in a block.
Web3 architecture was originally designed to completely eliminate trust in humans, handing control over to mathematics. Hack statistics demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and a decentralized community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms at all, but in the fact that there are still people at both ends of the wire.
My conclusion: the industry is moving from the "trust the code" paradigm to the "trust the process" paradigm. Without revising governance mechanisms and implementing preventive monitoring systems, we will continue to watch billions of dollars disappear due to seemingly insignificant human errors.