Crypto news

July 2026 became a landmark month for the entire decentralized finance industry. The code of BonkDAO — the governance structure of the Solana-based memecoin — worked flawlessly, without a single error. Nevertheless, about $20 million disappeared without a trace from the organization's treasury. There was no hack in the classical sense: the vote was legitimate, and the transaction was executed in full compliance with the protocol.

This case is a vivid illustration of how governance attacks are becoming the new norm, and the human factor is turning into the primary target for malicious actors. At the same time, traditional hacking methods are being replaced by automated vulnerability discovery using artificial intelligence, which radically changes the threat landscape.

Attack on Decentralization: The BonkDAO Lesson

On July 6, 2026, BonkDAO faced a governance takeover that resulted in the theft of approximately 4.43 trillion BONK tokens. The attacker did not use exploits but acted through a transaction that was legal from the code's perspective, exploiting fundamental weaknesses in the DAO's architecture and the community's passivity.

The scheme was simple and elegant. Disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly rewarded voting participants, the hacker embedded a malicious function that transferred treasury funds to his address. To reach quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

This incident exposed a critical flaw in the system: the lack of a time-delay mechanism for executing decisions and an excessively low quorum threshold. The team had no veto rights, making the attack irreversible. The attacker did not hack the code — he simply carefully read the organization's charter and found a weak spot in it.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) via a malicious proposal. With voter turnout at 4–5% of the total token supply, a 1% stake was enough to control the vote. That attack was repelled, but only after the proposal was passed and through negotiations.

Low turnout and token concentration are not a bug in the code but a systemic problem with decentralization mechanisms in Web3. As early as the beginning of 2026, Ethereum co-founder Vitalik Buterin called on the community to develop more advanced forms of DAOs, calling the dominant token-based governance model "unproductive and weak" and vulnerable to capture.

Audit Is Not a Panacea

While holes are being sought in DAO governance without a single line of exploit code, the problems with code are the opposite. According to my data analysis, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding complex zero-day vulnerabilities — attackers used long-known methods:

• reentrancy errors;
• access control errors;
• oracle manipulation;
• logical errors in the protocol's business logic.

Cross-chain bridges remain the most vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is physically difficult to assess in its entirety.

2026 demonstrated several telling examples. In January, the verification protocol Truebit lost $26.4 million due to an integer overflow in a legacy contract. In February, attackers gained control of a private key belonging to the IoTeX bridge validator and withdrew $4.4 million. And in April, the largest DeFi exploit of the year was an attack on the restaking protocol Kelp: about 116,500 rsETH worth $292 million was drained from the LayerZero bridge.

AI as a New Threat

While specialists were studying recurring patterns, they gained an adversary for whom such analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation, neural networks successfully attacked 207 of 405 actually hacked contracts, withdrawing a total of $550.1 million. In practice, this is already happening: specialists are recording multiple nearly identical hacking attempts on different contracts simultaneously, indicating automated vulnerability scanning.

The Key Matters More Than the Contract

No smart contract audit could have prevented the largest thefts of the past two years. Private key theft accounted for about 40% of stolen funds — more than any other attack vector. The Bybit hack in February 2025 is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with the fund transfer process by substituting data in the Safe interface. In June 2026, Humanity Protocol suffered a similar fate, losing $31 million due to key access through a developer's infected computer.

The industry is changing its approach to security: MPC wallets, account abstraction with social recovery, and passkey authentication are being implemented. Protection is shifting from one-time checks to dynamic real-time threat monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool even before a transaction is included in a block. The proactive response model has already proven effective: in September 2025, the Hexagate system detected preparations for an attack on the Venus protocol 18 hours in advance, which made it possible to prevent the theft.

Web3 architecture was designed to eliminate trust in humans by handing control over to mathematics. But the statistics of recent years demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms at all, but in the fact that there are still people at both ends of the wire.

My conclusion: the industry is on the verge of a fundamental reassessment of the security paradigm. As long as we rely on formal code checks while ignoring the human factor and social engineering, we will witness increasingly sophisticated attacks on governance and infrastructure. It is necessary to shift the focus from one-time audits to comprehensive monitoring and behavioral analysis systems.