Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were drained from the treasury. There was no hack in the traditional sense: the vote was legitimate. This is a striking example of how governance attacks are becoming the new norm, and the human factor is turning into the primary target for malicious actors.

Attack on Decentralization

On July 6, 2026, BonkDAO faced a governance takeover. The attacker exploited fundamental weaknesses in the DAO's architecture and community passivity. Disguised as a routine initiative, Bonk Improvement Proposal #76, which proposed rewarding participants, the hacker added a malicious function to transfer funds to their own address.

To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. The system had no mechanism for a time delay in executing decisions, and the quorum required to dispose of colossal sums turned out to be too low.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million). With typical voter turnout of 4–5%, such a package would have been enough to control the vote. That attack was only repelled through negotiations after the proposal was passed.

Low turnout and token concentration are not a bug in the code, but a problem with decentralization mechanisms in Web3. As early as the beginning of 2026, Vitalik Buterin urged the community to develop more advanced forms of DAOs, calling the dominant token-based governance model weak and vulnerable to capture.

Audit Is Not a Guarantee of Security

According to analysts, in 2025 the number of incidents in Web3 fell by nearly half — to ~200, yet total losses rose from $2 billion to $2.9 billion. Chainalysis experts estimate the damage even higher — at $3.4 billion. Notably, 90% of hacked smart contracts had successfully passed audits. Attackers use long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is physically difficult to assess in its entirety.

2026 provided several illustrative examples:

1. On January 8, the Truebit protocol lost $26.4 million due to an integer overflow in a legacy contract.
2. On February 21, attackers gained control of the validator key of the IoTeX bridge and withdrew $4.4 million, minting over 111 million tokens.
3. On April 18, the largest DeFi exploit of the year was the attack on the Kelp protocol: approximately 116,500 rsETH worth $292 million were drained from the LayerZero bridge.

AI as a New Threat

While specialists were studying recurring patterns, an adversary emerged for whom analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation, neural networks successfully attacked 207 of 405 real-world hacked contracts, draining $550.1 million. In practice, this is already happening: Chainalysis records multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability scanning.

The Key Matters More Than the Contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis, private key theft accounted for about 40% of stolen funds. The Bybit hack on February 21, 2025, is telling: the exchange lost $1.46 billion in ETH. Attackers interfered with the fund transfer process: in the Safe interface, signers saw tampered data and approved a transaction that transferred control of the wallet. Similarly, in June 2026, Humanity Protocol suffered, losing $31 million due to keys stored on a developer's infected computer.

What Actually Works?

The industry is changing its approach to storage and transaction confirmation: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware vaults. Protection is shifting from one-off checks to dynamic real-time monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven effective: on September 2, 2025, the Hexagate system detected preparations for an attack on the Venus protocol 18 hours in advance and automatically paused it 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, handing control over to mathematics. Statistics show the opposite effect: perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms, but in the fact that there are still people at both ends of the wire.

My conclusion: the industry is transitioning from the "audit as a guarantee" paradigm to a model of "continuous monitoring and multi-layered protection." However, as long as key decisions are made by people, perfect security will not exist. We need not just to improve code, but to change the security culture and decision-making processes in DAOs.