Crypto news

The code of BonkDAO, the governing organization of the Solana memecoin, worked flawlessly in July 2026. And yet, about $20 million left the treasury. There was no hack in the classic sense: the vote was legitimate. This is a striking symptom of how governance attacks are becoming the norm, and the human factor is turning into the primary vector for malicious actors.

Seizing Decentralization: Anatomy of the BonkDAO Attack

On July 6, 2026, BonkDAO faced a governance takeover that resulted in the theft of approximately 4.43 trillion BONK tokens. The attacker, exploiting community apathy and fundamental weaknesses in the DAO's architecture, executed a transaction that was legal from the code's perspective.

The scheme was simple and elegant. Disguised as a routine Bonk Improvement Proposal #76, promising rewards to participants, the hacker embedded a malicious function to transfer funds. To reach quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

This case exposed critical flaws: the lack of a time delay for executing decisions (timelock), a quorum threshold that was too low for managing enormous sums, and the absence of an emergency veto right for the team. The attacker simply read the organization's charter carefully.

A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million), but the attack was repelled after the proposal was adopted—through negotiations. The essence of the problem is not the code, but the mechanisms of decentralization, which become a fiction at low turnout. Unsurprisingly, Vitalik Buterin, as early as the beginning of 2026, called for a revision of the dominant token-based governance model, calling it weak and vulnerable to capture.

Audit Is Not a Panacea

While DAOs search for holes in governance, the situation with code is paradoxical. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not use complex zero-day vulnerabilities but employed long-known methods: reentrancy errors, access control issues, oracle manipulations, and logical errors in business logic.

Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022—about 40% of all stolen funds in Web3. The year 2026 provided several telling examples:

1. Truebit (January 8): loss of $26.4 million due to integer overflow in a legacy contract deployed five years ago.
2. IoTeX (February 21): control over the bridge validator's private key allowed updating the contract to a malicious version and withdrawing $4.4 million.
3. Kelp (April 18): the largest DeFi exploit of the year—$292 million from the LayerZero bridge due to a single validator and an attack on RPC infrastructure.

Badges from CertiK and Code4rena did not help. The industry faces the need to rebuild its defenses, especially as a new adversary—artificial intelligence—enters the scene.

Prompt Instead of Auditor

In December 2025, Anthropic announced the use of AI models to find vulnerabilities. On the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, "withdrawing" $550.1 million. Even on contracts hacked after March 2025 (outside the training data), AI showed high effectiveness. Already in June, Chainalysis specialists recorded multiple synchronous hacking attempts on dozens of contracts, indicating automated vulnerability scanning. The entry barrier to hacking is lowering faster than the quality of defense is growing.

The Key Matters More Than the Contract

However, no audit would have prevented the largest thefts of the past two years. According to Chainalysis, private key theft accounted for about 40% of all stolen funds. The Bybit hack in February 2025 ($1.46 billion) and the Humanity Protocol hack in June 2026 ($31 million) are vivid examples. In both cases, attackers targeted not the blockchain but the infrastructure around it: they substituted data in the Safe interface or gained access to backup copies of keys on developers' infected computers.

What Actually Works?

The industry is shifting focus from one-time checks to dynamic protection. MPC wallets that eliminate a single point of failure, account abstraction with social recovery, and passkey authentication to combat phishing are being implemented. Real-time monitoring systems such as Forta Network and Hypernative are beginning to play a key role. The case of the Venus protocol in September 2025 is telling: Chainalysis's Hexagate system detected suspicious activity 18 hours before the attack and automatically paused the protocol, preserving funds.

Web3 architecture was created to eliminate trust in humans, but statistics show the opposite. Perfect code is powerless if a developer clicks a phishing link, and a DAO community sleeps during a takeover. It seems the main systemic vulnerability of the blockchain economy is people on both ends of the wire.

My conclusion: we are witnessing a fundamental shift in cybersecurity. While the industry seeks perfect code, hackers exploit the most unpredictable variable—the human. Projects that do not rebuild their security systems with this in mind will pay a very high price for this lesson.