Crypto news

July 2026 will be remembered by the crypto industry not for another exploit in code, but for a perfectly legal theft. The BonkDAO code — the governing body of the Solana-based memecoin — executed without a single error. Nevertheless, about $20 million disappeared from the organization's treasury. There was no hack in the classic sense: the vote was conducted fairly, and the transaction was executed in full compliance with protocol rules.

Attack on decentralization

On July 6, 2026, BonkDAO faced a governance takeover. The attacker siphoned off approximately 4.43 trillion BONK tokens, exploiting fundamental flaws in the DAO's architecture and community apathy. Disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly offered rewards to voters, the hacker embedded a malicious function to transfer funds to their own address.

To reach quorum, they spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. With extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. Critical protection mechanisms — such as a timelock allowing the cancellation of an anomalous transaction, or veto rights for the team — simply did not exist.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. At that time, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million), exploiting a low turnout of 4–5%. That attack was repelled, but only through negotiations after the proposal had passed. The problem lies not in code errors, but in the tokenocracy model itself.

Vitalik Buterin warned back in early 2026: the dominant token-based governance model is unproductive, vulnerable to capture, and "completely fails at mitigating the shortcomings of human politics."

Audit is no guarantee

While DAOs suffer from "legal" attacks, smart contracts are being hacked using old methods. According to Kerberus analysts, 90% of contracts compromised in 2025 had successfully passed audits. Attackers are not hunting for complex zero-day vulnerabilities — classic errors suffice: reentrancy, access control issues, oracle manipulation, or logical bugs in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of such systems creates a massive attack surface that is difficult to assess in its entirety.

Incidents from 2026 are telling:

1. Truebit lost $26.4 million due to an integer overflow in a legacy contract.
2. The IoTeX bridge was compromised via a validator's private key — $4.4 million was drained and 111 million tokens were minted.
3. The largest exploit of the year — an attack on the Kelp protocol: $292 million in rsETH was drained through the LayerZero bridge due to a single validator and an attack on RPC infrastructure.

Badges from CertiK and Code4rena do not protect against such vectors.

AI as a new threat

The situation is exacerbated by the advancement of AI. In December 2025, Anthropic announced the creation of the SCONE-bench benchmark: out of 405 real-world hacked contracts, neural networks successfully attacked 207, extracting a simulated $550.1 million. When tested on 34 contracts compromised after March 2025, the models also demonstrated high effectiveness. Chainalysis is already recording multiple synchronous hacking attempts against dozens of contracts — this is automated enumeration, unattainable for humans. The barrier to entry into hacking is rapidly falling.

The key decides everything

However, no audit would have prevented the largest thefts. According to Chainalysis data for 2024, private key theft is the cause of ~40% of all stolen funds. A textbook example is the Bybit hack in February 2025 for $1.46 billion, when signers approved a swapped transaction in the Safe interface. A similar fate befell Humanity Protocol in June 2026: keys were stolen via a backup on a developer's infected computer, with losses of $31 million.

The industry is responding: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Protection is shifting from one-time checks to dynamic monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol example showed: an automatic pause 20 minutes before an attack saved funds.

Web3 was designed as a system that eliminates trust in humans. But statistics say otherwise: perfect code is powerless if a developer clicks on a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in algorithms, but in the fact that at both ends of the wire, there are still people.

My conclusion: we are witnessing a fundamental paradigm shift. The crypto industry has outgrown the stage where security was ensured solely by code quality. Now it is a comprehensive discipline where risk management, behavioral analytics, and speed of threat response matter more than formal checks. Projects that fail to realize this are the next candidates for headlines about hacks.