The human factor as the main exploit: why code no longer decides
July 2026 will be remembered as the moment when decentralized governance cracked. The code of BonkDAO — the governing structure of the Solana memecoin — worked flawlessly, but about $20 million evaporated from the treasury. There was no hack in the classic sense: the vote was legitimate, and the transaction was completely valid from the protocol's perspective. This is not a bug; it's a feature we designed for ourselves.
An attack on trust, not on code
On July 6, 2026, BonkDAO faced a governance takeover. The attacker, using the routine proposal BIP #76 on participant rewards, embedded a malicious function to transfer funds. Spending about $4.4 million on centralized exchanges, he bought up 1% of the BONK supply, which was enough to reach a quorum with low turnout. Six days later, the proposal automatically executed, siphoning off 4.43 trillion tokens.
The root of the problem lies in the DAO's architecture itself. The lack of a time lock to cancel anomalous decisions, a low quorum threshold, and the absence of a team veto turned governance into a formality. This is not the first case: a year earlier, a similar attempt was made against Compound, but there the attack was repelled through negotiations. Notably, Vitalik Buterin had already criticized token-oriented DAOs in early 2026 for being vulnerable to takeovers and inefficient, but the industry keeps stepping on the same rake.
Audit is not a panacea
While DAOs suffer from governance gaps, smart contracts demonstrate the opposite problem. According to Kerberus analysts, 90% of contracts hacked in 2025 had successfully passed audits. Attackers do not seek complex zero-day vulnerabilities — they use time-tested methods: reentrancy, access control errors, oracle manipulation, and logic bugs in business logic.
The year 2026 is especially telling. The Truebit hack of $26.4 million due to integer overflow in a five-year-old contract, the attack on the IoTeX bridge through the compromise of a validator's private key, and finally, the largest exploit of the year — the withdrawal of $292 million from Kelp through a single LayerZero validator. Everywhere — not the absence of audits, but blind faith in their results.
AI in the service of hackers
The situation is exacerbated by the rapid development of AI. In December 2025, Anthropic introduced the SCONE-bench benchmark: neural networks successfully attacked 207 out of 405 actually hacked contracts, "earning" $550 million in simulation. This is not theory — Chainalysis is already recording multiple synchronous hacking attempts on dozens of contracts, indicating automated attacks. The barrier to entry in hacking has dropped to formulating the right prompt.
The key is the weakest link
However, the most painful lesson of recent years is the theft of private keys. According to Chainalysis, this vector is responsible for 40% of all stolen funds. The Bybit hack of $1.46 billion in February 2025 and the loss of $31 million by Humanity Protocol in June 2026 are vivid examples of how data substitution in the interface or a developer's infected computer nullifies any technical sophistication.
A new protection paradigm
The industry's response is shifting focus from one-time checks to dynamic protection. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are becoming the standard. But the main thing is the implementation of real-time monitoring systems. The example of Venus Protocol, where an attack was prevented 20 minutes before the final transaction thanks to an automatic pause, proves: a preventive approach works.
My conclusion: We built an industry on the idea of radically eliminating trust in humans, but the statistics are relentless — it is humans who remain the most exploited vulnerability. Perfect code is powerless against a phishing link or a dormant community. Until we acknowledge that "people are the bug" that cannot be patched but can be mitigated, the vulnerability will remain fundamental.