Crypto news

July 2026 will be remembered as the moment when the DAO code worked perfectly, but the people did not. Approximately $20 million was withdrawn from the treasury of BonkDAO, the governing organization of the Solana memecoin. There was no hack in the classic sense: the vote was legitimate, and the smart contract flawlessly executed its logic. This is not an isolated incident, but a warning sign that the architecture of decentralization in Web3 is experiencing systemic failures that hackers exploit with alarming efficiency.

Attack on Decentralization: When the Rules of the Game Turn Against You

On July 6, 2026, an attacker pulled off an operation that will go down in cybersecurity textbooks. Disguised as a routine proposal, Bonk Improvement Proposal #76, which promised rewards to participants, a malicious function for transferring funds was embedded. Spending about $4.4 million on centralized exchanges, the attacker bought 1% of the total BONK supply—enough to gain control of nearly 100% of the votes with low turnout and automatically drain the treasury six days later.

This case exposed fundamental flaws in token voting: the lack of a time delay for executing decisions, too low a quorum threshold, and the inability for the team to veto. A year earlier, a similar attempt was made against the Compound protocol's DAO, but that attack was repelled. The problem is not code errors, but the governance model itself, where community passivity and token concentration become an attack vector. Ethereum co-founder Vitalik Buterin warned as early as early 2026 about the inefficiency of such systems, calling them "vulnerable to capture."

Audit Is Not a Panacea: Old Bugs and New Tools

While DAOs suffer from the "human factor," smart contracts continue to be broken using long-known methods. Analysts at Kerberus calculated that 90% of contracts hacked in 2025 had successfully passed audits. Attackers do not seek complex zero-day vulnerabilities but use classic reentrancy errors, access control issues, and oracle manipulations. Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022—about 40% of all stolen funds in Web3.

The incidents of 2026 are telling: the Truebit hack for $26.4 million due to integer overflow, the attack on the IoTeX bridge through control of a validator's private key, and the year's largest exploit—the theft of $292 million from the Kelp protocol due to a single cross-chain message validator. All these cases share one thing: badges from CertiK and Code4rena did not help.

AI as a New Threat and Next-Generation Defense

The situation is exacerbated by the development of artificial intelligence. In December 2025, Anthropic announced that AI models successfully attacked 207 out of 405 real hacked smart contracts as part of the SCONE-bench benchmark. This means the barrier to entry for hacking has radically lowered: now, finding vulnerabilities does not require an experienced Solidity developer—just a well-formulated query. Chainalysis analysts are already recording automated synchronous attacks on dozens of contracts, which is impossible with manual work.

However, the most dangerous vector remains private key theft, which in 2024 accounted for about 40% of all stolen funds. The Bybit hack for $1.46 billion in February 2025 and the attack on Humanity Protocol with damages of $31 million are vivid examples of how compromising a work device or data substitution in the interface nullifies any technical security measures.

What Works: Dynamic Defense

The industry is gradually moving away from one-time audits toward real-time threat monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol case in September 2025 demonstrated the effectiveness of this approach: the attack was prevented 20 minutes before the final transaction, and funds remained safe.

Web3 architecture was created to eliminate trust in humans, but the statistics are relentless: perfect code is powerless against a phishing link or a dormant community. Perhaps the main lesson of recent years is the realization that the systemic vulnerability of the blockchain economy lies not in algorithms, but in the people who govern them. And until that changes, any technological innovation will only delay the next major hack.