The main bug of Web3 is the human: how governance attacks and AI are changing the rules of the game
July 2026 will be remembered as the moment when the code of one of the most famous memecoin projects on Solana — BonkDAO — worked flawlessly, but that did not save the treasury. About $20 million was withdrawn legally, without a single hack in the classic sense. The vote was real, but this only underscores a worrying trend: governance attacks are becoming the norm, and the human factor is the primary target for malicious actors.
Attack on decentralization: when code doesn't help
On July 6, BonkDAO faced a governance takeover. The attacker, using the routine proposal BIP #76, added a malicious function to transfer funds. After spending about $4.4 million on centralized exchanges, he bought up 1% of the BONK supply, which was enough to control nearly 100% of the votes amid extremely low turnout. Six days later, the transaction executed automatically.
This case exposed fundamental flaws in the architecture: the lack of a time delay for execution, low quorum, and the absence of veto power for the team. This is not an exploit but a systemic problem with decentralization mechanisms. A year earlier, a similar attempt against Compound was thwarted, but only at the negotiation stage. Unsurprisingly, Vitalik Buterin, back in early 2026, called for a rethink of the token-voting model, calling it weak and vulnerable to capture.
Audits are not a panacea, and AI is a new threat
While some look for holes in governance, others face problems in code. According to analysts, in 2025 the number of incidents in Web3 fell, but losses rose to $2.9–3.4 billion. A worrying signal: 90% of hacked smart contracts had successfully passed audits. Attackers use outdated methods — reentrancy, access errors, oracle manipulation. Cross-chain bridges suffer the most, having lost over $2.8 billion since 2022.
However, the main new challenge is artificial intelligence. During tests, Anthropic models successfully attacked 207 of 405 real-world hacked contracts, and in June 2026, Chainalysis recorded automated synchronous attacks on dozens of targets. The barrier to entry into hacking is dropping faster than the quality of defense is improving.
The key matters more than the contract
But even perfect code doesn't help when a key is stolen. About 40% of all stolen funds in 2024 were the result of private key theft. The cases of Bybit ($1.46 billion) and Humanity Protocol ($31 million) are vivid examples where the attack targeted the human factor and software, not the blockchain.
The industry is responding by moving to MPC wallets, account abstraction, and dynamic monitoring. Systems like Hexagate have already proven effective, preventing an attack on Venus Protocol 20 minutes before disaster. But the main takeaway remains unchanged: the Web3 architecture, designed to eliminate trust in humans, in reality demonstrates its critical importance. As long as there are people at both ends of the wire, perfect code will remain just a beautiful theory.
My view: the industry needs to stop relying on one-off audits and move to comprehensive security hygiene, where key protection and real-time threat monitoring play no less a role than smart contract verification. Otherwise, we will keep treating the symptoms, not the disease.