The human factor: the main vulnerability of Web3 that an audit cannot fix
July 2026 became a landmark month for the industry: the code of BonkDAO, the governing organization of the eponymous meme coin on Solana, worked perfectly. And it was precisely this that allowed attackers to drain approximately $20 million from the treasury. There was no hack in the classic sense — the vote was legitimate, and the code executed exactly what was required of it.
This incident is a vivid illustration of how attacks on governance mechanisms are becoming the new norm. The human factor and community passivity now play into hackers' hands just as much as code errors. Moreover, AI analysis of old smart contracts has turned into a double-edged sword: it helps defenders find vulnerabilities, but in the hands of attackers, it becomes a universal skeleton key.
Seizing Decentralization
On July 6, 2026, BonkDAO faced a classic governance takeover. The attacker, exploiting community passivity, initiated a vote on proposal BIP #76, which was disguised as a routine reward distribution. Inside, however, a malicious function was hidden that transferred treasury funds to the attacker's address.
To reach a quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. That was enough to control nearly 100% of the votes with low turnout. Six days later, the proposal was automatically executed.
The attack exposed fundamental flaws in the DAO's architecture: the lack of a time delay for execution, too low a quorum threshold for managing huge sums, and the absence of emergency veto power for the team. This is not an isolated case. A year earlier, a similar attempt was made against Compound, but it was repelled. Then, as now, the problem lay not in the code, but in the decentralization mechanisms that allow power to be concentrated in a single pair of hands.
Audit Is Not a Panacea
Notably, according to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers do not seek complex zero-day vulnerabilities; they use long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.
Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022 — about 40% of all stolen funds in Web3. The complexity of their architecture creates a broad attack surface that is extremely difficult for the human eye to assess.
2026 provided several telling examples: the Truebit hack of $26.4 million due to integer overflow in an old contract, the attack on the IoTeX bridge via compromise of a validator's private key, and the year's largest exploit — the theft of $292 million from Kelp through a single LayerZero cross-chain message validator.
AI as a New Player
While specialists analyzed recurring patterns, an adversary emerged for whom such analysis is a routine task. As early as December 2025, Anthropic announced the use of AI models to find vulnerabilities. In tests on the SCONE-bench benchmark, neural networks successfully attacked 207 of 405 actually hacked contracts, "withdrawing" $550.1 million. This indicates that the barrier to entry into hacking is lowering faster than the quality of defense is improving.
But even the most perfect audit would not have saved against the largest thefts. According to Chainalysis, private key theft accounted for about 40% of all stolen funds. The $1.46 billion Bybit hack in February 2025 is a striking example: attackers tampered with data in the Safe interface, and signers approved an externally correct transaction. A similar scheme worked against Humanity Protocol in June 2026, when keys were stolen via a developer's infected computer.
The industry is gradually shifting from one-off checks to dynamic monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool in real time. The Venus Protocol example showed that proactive blocking 20 minutes before the final transaction can save millions.
Web3 architecture was designed to eliminate trust in humans, handing control over to mathematics. But the statistics of recent years demonstrate the opposite: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy is people on both ends of the wire. And until we solve this problem, no audits or AI defenders will make the industry truly secure.