Crypto news

July 2026 became a landmark month for decentralized finance security. The code of BonkDAO — the governance structure of the Solana-based memecoin — worked flawlessly, without a single error. Yet, about $20 million evaporated from the organization's treasury. There was no hack in the classic sense: the vote was legitimate, but with catastrophic consequences.

Attack on Decentralization: How It Works

On July 6, an attacker seized control of BonkDAO, stealing approximately 4.43 trillion BONK tokens. Instead of hacking the code, he exploited the architectural weaknesses of the DAO and community apathy. Disguised as a routine proposal, BIP #76, about rewarding voters, the hacker embedded a malicious function to transfer funds to his own address.

To reach a quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the BONK supply. With extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. The system had neither a time-delay mechanism nor emergency veto rights — only a quorum threshold that was far too low for managing such vast sums.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO, trying to withdraw 499,000 COMP (~$24.1 million). That attack was thwarted, but only after the proposal passed and through negotiations. The problem is obvious: low turnout and token concentration are not a bug in the code but a fundamental flaw in Web3 governance mechanisms. Unsurprisingly, Vitalik Buterin, as early as the beginning of 2026, called for a rethink of the dominant token-centric DAO model, labeling it vulnerable to capture.

Audit Is Not a Panacea

While DAOs suffer from the "human factor," the situation with code is no better. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not seek complex zero-day vulnerabilities but used long-known methods: reentrancy, access control errors, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-network messages creates a huge attack surface. Notable examples from 2026:

1. Truebit lost $26.4 million due to an integer overflow in a legacy contract deployed five years ago.
2. The IoTeX bridge was compromised through the theft of a validator's private key, allowing the contract to be updated to a malicious version and $4.4 million to be drained.
3. The largest exploit of the year — the attack on Kelp, where approximately 116,500 rsETH worth $292 million were drained from the LayerZero bridge due to a single validator and an attack on RPC infrastructure.

AI as a New Hacker Tool

In December 2025, Anthropic announced the use of AI to find vulnerabilities. In a simulation on the SCONE-bench benchmark, neural networks successfully attacked 207 out of 405 real-world hacked contracts, extracting a virtual $550.1 million. Chainalysis is already recording multiple synchronous hacking attempts on different contracts, indicating automated vulnerability scanning. The barrier to entry into hacking is falling faster than the quality of defense is improving.

The Key Matters More Than the Contract

However, no audit would have prevented the largest thefts of recent years. According to Chainalysis, private key theft is the cause of about 40% of all stolen funds. The $1.46 billion Bybit hack in February 2025 is a striking example: attackers swapped data in the Safe interface, and signers approved a transaction that transferred control of the wallet. In June 2026, Humanity Protocol lost $31 million due to keys stored on a developer's infected computer.

What Works?

The industry is shifting from one-off checks to dynamic protection: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Real-time monitoring systems such as Forta Network and Hypernative have already proven effective. In September 2025, Hexagate by Chainalysis detected preparations for an attack on Venus 18 hours in advance and automatically paused the protocol 20 minutes before the final transaction, preserving the funds.

My view: We are witnessing a fundamental paradigm shift. Web3 was designed as a system that eliminates trust in humans, but the statistics are relentless: the weakest link is people. Perfect code is powerless against a phishing link or a dormant DAO. Until the industry rethinks its approach to governance and key custody, any technical innovation will only be a temporary reprieve from the inevitable.