Crypto news

July 2026 will be remembered by the crypto industry not for hype, but for a telling incident: the code of BonkDAO — the governing structure of the Solana memecoin — ran without a single glitch. And yet, about $20 million evaporated from the organization's treasury. There was no hack in the classic sense: the vote was legitimate, and the transaction was executed in full compliance with the code. This is not a bug, it's a feature that cost millions.

Attack on decentralization: when the code is not to blame

On July 6, 2026, BonkDAO faced a governance takeover. The attacker stole approximately 4.43 trillion BONK tokens, exploiting fundamental flaws in the DAO's architecture and community apathy. Disguised as a routine proposal, Bonk Improvement Proposal #76, which promised rewards for voting participation, the hacker embedded a malicious function that transferred funds to his address.

To achieve quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against the backdrop of low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. The system had no time-delay mechanism, no team veto power, and no adequate quorum threshold for such large sums.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO: attackers sought to withdraw 499,000 COMP tokens (~$24.1 million) using a malicious proposal. With a turnout of 4–5%, control over the vote was achieved, but the attack was repelled only after the decision was made — through negotiations. The problem is not in the code, but in the very mechanisms of decentralization, which prove vulnerable to token concentration and holder passivity.

Audit is not a panacea

While DAOs search for holes in governance, smart contracts suffer from the opposite problem. According to analysts, 90% of contracts hacked in 2025 had successfully passed audits. Attackers do not seek complex zero-day vulnerabilities — they use long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in the protocol's business logic. Cross-chain bridges, which have lost over $2.8 billion since 2022 (about 40% of all stolen funds in Web3), remain the most tempting target due to their complexity and multi-component nature.

2026 provided several telling examples: the Truebit hack for $26.4 million due to integer overflow in a legacy contract, the attack on the IoTeX bridge with control over a validator's private key, and the year's largest exploit — the withdrawal of $292 million from the Kelp protocol via the LayerZero bridge. All of these are not high-tech attacks, but the exploitation of long-known weaknesses.

AI in the service of hackers

The situation is exacerbated by the development of artificial intelligence. In December 2025, Anthropic announced testing AI models on the SCONE-bench benchmark, consisting of 405 real hacked contracts. The neural networks successfully attacked 207 of them, "withdrawing" $550.1 million. The barrier to entry into hacking is rapidly falling: now, finding vulnerabilities no longer requires an experienced Solidity developer — just formulating the right prompt is enough.

The key matters more than the contract

However, no audit would have saved against the largest thefts of recent years. According to Chainalysis, private key theft accounted for about 40% of all stolen funds — more than any other attack vector. The Bybit hack for $1.46 billion in February 2025 is the most striking example: attackers replaced data in the Safe interface, and signers approved an outwardly correct transaction, handing control of the wallet to hackers. Similarly, Humanity Protocol suffered, losing $31 million due to malware on a developer's computer.

The industry is gradually shifting focus from one-off audits to dynamic monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool in real time. The case of Venus Protocol in September 2025 is telling, when an automated system detected suspicious activity 18 hours before the attack and stopped the protocol 20 minutes before the final transaction, preserving funds.

My conclusion: We built complex systems designed to eliminate human trust, but in the end we hit the reality that humans remain the weakest link. Perfectly written code is powerless against a phishing link opened by a developer, or a community that sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms, but in ourselves.