Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO, the governing organization of the Solana memecoin, worked flawlessly, but that did not stop attackers from draining approximately $20 million from the treasury. There was no hack in the classic sense—the vote was legitimate, and the transaction was fully valid from a code perspective.

This incident is a striking example of how governance attacks are becoming the new norm, and the human factor is turning into the primary target for hackers. At the same time, the industry is facing a new threat in parallel: AI-driven analysis of old smart contracts is becoming both a boon for security and a universal master key for malicious actors.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens from the treasury. The attacker exploited fundamental weaknesses in the DAO architecture and community passivity. Under the guise of a routine initiative, Bonk Improvement Proposal #76, which proposed rewards for voting participants, they embedded a malicious function to transfer funds to their own address.

To reach quorum, the attacker spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. Critical system vulnerabilities: the absence of a time delay for executing decisions, a low quorum threshold, and the lack of emergency veto rights for the team.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO: attackers tried to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only after the fact—through negotiations. The problem is not the code, but the mechanisms of Web3 decentralization: low turnout and token concentration make the system vulnerable. Unsurprisingly, as early as the beginning of 2026, Vitalik Buterin called for reconsidering the dominant token-based governance model, calling it "unproductive, weak, and vulnerable to capture."

Audit Is Not a Security Guarantee

While DAO governance suffers from "human" holes, the situation with code is paradoxical. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day exploits—long-known methods were used: reentrancy errors, access control flaws, oracle manipulations, and business logic errors.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion—about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a huge attack surface that is difficult to assess in its entirety. Notable examples from 2026: the Truebit hack of $26.4 million due to an integer overflow in a five-year-old contract; an attack on the IoTeX bridge validator with $4.4 million withdrawn; and the largest exploit of the year—the attack on Kelp, where 116,500 rsETH worth $292 million were drained from the LayerZero bridge.

AI—A New Player on the Battlefield

While specialists studied recurring patterns, an adversary emerged for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find flaws in smart contracts. During a simulation on the SCONE-bench benchmark (405 real hacked contracts), neural networks successfully attacked 207 of them, extracting $550.1 million. By June, Chainalysis analysts recorded anomalous activity: multiple nearly identical hack attempts on different contracts simultaneously, indicating automated vulnerability brute-forcing. The barrier to entry into hacking is dropping faster than the quality of defense is improving.

The Key Matters More Than the Contract

However, no audit could have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft accounted for about 40% of all stolen funds. The Bybit hack in February 2025 ($1.46 billion in ETH) is a prime example: attackers tampered with data in the Safe interface, and signers approved an externally correct transaction. In June 2026, Humanity Protocol lost $31 million due to keys stolen from a developer's infected computer.

A Paradigm Shift in Defense

The industry is being forced to change. One-off audits are being replaced by dynamic monitoring systems. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are becoming the standard. Proactive response has already proven effective: in September 2025, Chainalysis's Hexagate system detected preparation for an attack on Venus Protocol 18 hours in advance and automatically paused the protocol 20 minutes before the final transaction, preserving the funds.

Web3 architecture was designed to eliminate trust in humans, handing control over to mathematics. But the statistics demonstrate the opposite: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms, but in the people at both ends of the wire.

My view: the industry is undergoing a fundamental shift. We are moving from an arms race in code to a race in processes and infrastructure. Projects that fail to restructure their governance and security systems to account for the human factor and AI threats risk becoming the next statistic in Chainalysis reports.