Crypto news

July 2026 became a landmark month for the entire decentralized finance ecosystem. The BonkDAO code — the governing structure of the Solana memecoin — worked flawlessly, without a single error. And yet, about $20 million vanished without a trace from the treasury. There was no hack in the classical sense: the vote was legitimate, and the transaction was executed in full compliance with the code.

This incident is the most striking symptom of a systemic problem that is becoming the new norm. It concerns attacks on governance mechanisms, where the main vector is not a technical vulnerability, but human apathy and the imperfection of governance models.

Governance Takeover: Legal Theft

On July 6, 2026, an attacker pulled off an operation that will go down in DeFi security textbooks. Using the routine Bonk Improvement Proposal #76 on participant rewards, the hacker embedded a malicious function into it that automatically transferred funds to their address. To reach quorum, they spent about $4.4 million buying 1% of the total BONK supply on centralized exchanges. With low voter turnout, this was enough to control nearly 100% of the votes, and six days later the proposal executed automatically.

The root of the problem lies in the architecture of the DAO itself. The lack of a time delay for executing decisions, a low quorum threshold, and the absence of an emergency veto for the team turned the organization into easy prey. This is not an isolated case. A year earlier, a similar attempt was made against Compound, where attackers put a malicious proposal worth $24.1 million to a vote. That attack was repelled, but only after the fact — through negotiations, not technical means.

Ethereum co-founder Vitalik Buterin warned back in early 2026 about the weakness of token-oriented governance models. He rightly called them "vulnerable to capture" and incapable of solving problems of human politics. Low turnout and token concentration are not a bug, but a fundamental flaw in the concept of Web3 democracy.

Audit Is No Guarantee: AI in the Service of Hackers

While governance attacks strike at the logic of decentralization, classic code hacks demonstrate a frightening trend. Kerberus analysts calculated that 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers are not looking for complex zero-day vulnerabilities — they exploit errors known for years: reentrancy, access control issues, oracle manipulation, and logic bugs in business logic.

Particularly alarming is the use of artificial intelligence. In December 2025, Anthropic introduced the SCONE-bench benchmark, consisting of 405 real hacked contracts. AI models successfully attacked 207 of them, "withdrawing" a virtual $550.1 million. This means the barrier to entry into hacking has dropped catastrophically. Now, finding vulnerabilities no longer requires an experienced Solidity developer — just a properly formulated prompt. Chainalysis is already recording multiple synchronous attempts to hack dozens of contracts, indicating automated AI-driven attacks.

The largest incidents of 2026 confirm this trend: the Truebit hack for $26.4 million due to integer overflow, the compromise of the IoTeX bridge validator key, and the record Kelp exploit for $292 million, made possible by a single cross-chain message validator.

Keys, Not Code

However, the most alarming conclusion is that no audit would have saved against the largest thefts. According to Chainalysis, private key theft accounted for about 40% of all stolen funds — more than any other vector. The Bybit hack for $1.46 billion in February 2025 is the most striking example: signers in the Safe interface approved a swapped transaction, handing control of the wallet to hackers. Similarly, in June 2026, Humanity Protocol lost $31 million due to malware on a developer's computer.

The industry is forced to adapt. One-time checks are being replaced by dynamic real-time monitoring systems, such as Forta Network and Hypernative. The case of Venus Protocol is telling, where the Hexagate system detected attack preparation 18 hours in advance and automatically halted the protocol 20 minutes before the final transaction.

My expert view: We are witnessing a fundamental paradox. Web3 was created to eliminate trust in humans, but it is precisely the human who remains the weakest link. Perfect code is powerless against a phishing link or a dormant DAO community. Until the industry solves the human factor problem — through social key recovery, MPC wallets, and educational programs — any technical innovation will be merely a temporary bandage on a deep wound.