The human factor: why perfect code does not save the crypto industry from losses in the billions of dollars
July 2026 became a landmark month for understanding Web3 vulnerabilities. The governance code of BonkDAO — the organization behind the Solana-based memecoin — executed without a single error. However, this did not prevent attackers from siphoning approximately $20 million from the treasury. This was not a hack in the classic sense: the vote was completely legitimate from a technical standpoint.
Attack on Decentralization
The BonkDAO incident is a striking example of how architectural flaws in DAOs become weapons in the hands of attackers. On July 6, 2026, a hacker, using the routine Bonk Improvement Proposal #76, embedded a malicious function into it that provided for transferring funds to their address. To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. That was enough to control nearly 100% of the votes amid extremely low turnout.
The critical vulnerabilities were the lack of a time-delay mechanism for executing decisions, too low a quorum threshold, and the absence of veto power for the team. This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO, where attackers tried to withdraw $24.1 million. That attack was repelled, but only after the proposal was passed and through negotiations.
Audit Is Not a Panacea
While some look for holes in governance, others face the opposite problem — technical bugs that would seem to have been known for a long time. According to my data, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not use complex zero-day vulnerabilities but employed methods known for years: reentrancy errors, access control issues, oracle manipulations, and logical errors in protocol business logic.
This problem is especially acute for cross-chain bridges. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of their architecture creates a broad attack surface that is extremely difficult to assess in its entirety.
AI as a New Threat Vector
The situation is exacerbated by the development of artificial intelligence. In December 2025, Anthropic announced the creation of the SCONE-bench benchmark, consisting of 405 real hacked smart contracts. During the simulation, neural networks successfully attacked 207 of them, withdrawing $550.1 million. This means the barrier to entry into hacking is dropping catastrophically fast. Now, for a significant portion of typical attacks, it is enough to simply formulate a query to an LLM correctly.
The Key Matters More Than the Contract
However, no audit could have prevented the largest thefts of recent years. By my estimates, private key theft was the cause of about 40% of all stolen funds in 2024. The Bybit hack in February 2025 is telling, when the exchange lost $1.46 billion in ETH. Attackers swapped data in the Safe interface, and signers approved an externally correct transaction, handing control of the wallet to the hackers. A similar case occurred with Humanity Protocol in June 2026, where keys were stolen via a developer's infected computer.
What Actually Works?
The industry is gradually shifting from one-off checks to dynamic real-time threat monitoring. Projects are implementing MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Automated systems like Forta Network and Hypernative track anomalous activity in the mempool even before a transaction is included in a block. The proactive response model has already proven its effectiveness: in September 2025, Chainalysis's Hexagate system detected preparations for an attack on the Venus protocol 18 hours in advance and automatically paused it 20 minutes before the final transaction.
Web3 architecture was originally designed with the goal of completely eliminating trust in humans. However, the statistics of recent years demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy lies not in the algorithms at all, but in the fact that there are still people on both ends of the wire.
My conclusion: the industry needs to rethink its approach to security, shifting focus from purely technical audits to comprehensive protection of the human factor and decision-making processes. Otherwise, we risk seeing similar incidents repeat over and over again.