Crypto news

July 2026 will be remembered not for a hacker breach in the classic sense, but for the perfect exploitation of human apathy. The code of BonkDAO, the governance structure of the Solana memecoin, executed without a single error. Nevertheless, the treasury lost about $20 million. This was not an attack on a vulnerability, but a vote that was legal from the code's perspective and turned into a catastrophe.

Attack on decentralization: when code doesn't help

On July 6, 2026, an attacker pulled off a scheme that should become a case study for all DAOs. Disguised as a routine improvement (BIP #76) regarding participant rewards, a malicious fund transfer function was embedded into the proposal. To reach quorum, the hacker spent about $4.4 million, buying up 1% of the BONK supply on centralized exchanges. With low voter turnout, this was enough to control nearly 100% of the votes.

The key problem is not in the code, but in the governance architecture. The absence of a timelock mechanism and emergency veto left the team with no chance to save the funds. This is not an isolated case. A year earlier, a similar attempt was made against Compound, but the attack was repelled there. Low turnout and token concentration are a systemic disease of Web3, not a bug. Unsurprisingly, Vitalik Buterin called for a complete overhaul of the DAO concept as early as the beginning of 2026, calling the current model weak and vulnerable to capture.

Audit as fiction: 90% of hacked contracts were audited

While DAOs suffer from community inaction, smart contracts are being attacked using old, long-known schemes. Data from Kerberus analysts is shocking: 90% of contracts hacked in 2025 had successfully passed an audit. Attackers are not looking for complex zero-day vulnerabilities but are using classic reentrancy errors, access control issues, and oracle manipulation. Cross-chain bridges are especially affected, having lost over $2.8 billion since 2022 — about 40% of all stolen funds in the industry.

Notable cases of 2026:

1. Truebit (January) — lost $26.4 million due to an integer overflow in a legacy contract.
2. IoTeX (February) — control over the bridge validator's private key allowed updating the contract to a malicious version and withdrawing $4.4 million.
3. Kelp (April) — the largest exploit of the year: $292 million from the LayerZero bridge due to a single validator and an attack on RPC infrastructure.

AI as a new threat and salvation

The industry has faced an adversary for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced the creation of the SCONE-bench benchmark. AI models successfully attacked 207 of 405 real-world hacked contracts, extracting a simulated $550 million. The barrier to entry into hacking is dropping catastrophically fast. Now, to attack a typical contract, it is enough to formulate a prompt correctly, rather than be a Solidity expert. This is also confirmed by Chainalysis, which records multiple synchronous hacking attempts, indicating automated enumeration.

However, the main attack vector has shifted. According to Chainalysis data for 2024, private key theft is the cause of 40% of all losses. The $1.46 billion Bybit hack in February 2025 or the attack on Humanity Protocol in June 2026 ($31 million) are not code exploitation but the compromise of the human factor and work devices.

What works: dynamic protection

The industry is forced to adapt. One-time audits are being replaced by real-time monitoring systems such as Forta Network and Hypernative. These solutions track anomalies in the mempool before a transaction is included in a block. The case of Venus Protocol in September 2025 is illustrative, when Chainalysis's Hexagate system detected suspicious activity 18 hours before the attack and froze the protocol 20 minutes before the final transaction. Funds were saved, and hackers wasted their resources.

My conclusion: we have witnessed a fundamental shift. The idea of Web3 was to eliminate trust in humans through mathematics. But the reality is that the weakest link remains the human — their keys, their apathy, and their mistakes. Until the industry solves the problem of social engineering and governance, no audits or complex algorithms will save it from losses. Technology is improving, but people are not.