Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO, the governing organization of the Solana memecoin, ran without a single error, but about $20 million evaporated from its treasury. There was no hack in the classic sense—the vote was legitimate from the protocol's perspective. This is a stark signal: attacks on governance mechanisms are becoming the new norm, and the human factor is turning into the primary target for malicious actors.

Attack on decentralization: how it works

On July 6, BonkDAO faced a governance takeover. The attacker, exploiting community passivity, added a malicious function to the routine proposal BIP #76, disguised as participant rewards. Spending about $4.4 million on centralized exchanges, they purchased 1% of the BONK supply, which was enough to reach quorum amid low turnout. Six days later, the transaction executed automatically, draining 4.43 trillion tokens.

The root of the problem lies in the DAO's architecture itself: the absence of a time delay for executing decisions, a too-low quorum threshold, and no emergency veto mechanism. This is not an exploit but a fundamental flaw in the model. A year earlier, a similar attempt was made against Compound, but it was successfully repelled. However, the very fact of recurrence points to a systemic crisis. Unsurprisingly, Vitalik Buterin called for a rethink of outdated DAO models as early as early 2026, labeling them "weak and vulnerable to capture."

Audit is not a panacea

While DAOs suffer from "human" holes, smart contracts demonstrate the opposite problem. According to analysts, 90% of contracts hacked in 2025 had successfully passed audits. Attackers are not hunting for complex zero-day vulnerabilities but are using old, well-known methods: reentrancy errors, access control issues, and oracle manipulations.

Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022—about 40% of all stolen funds in Web3. The complexity of their architecture creates a vast attack surface that is difficult to assess in its entirety. Notable cases of 2026 include the Truebit hack ($26.4 million) due to integer overflow in an old contract, an attack on the IoTeX bridge validator ($4.4 million), and the year's largest exploit—the withdrawal of $292 million from the Kelp protocol via the LayerZero bridge.

AI: the hacker's new tool

The situation is exacerbated by advances in artificial intelligence. As early as December 2025, Anthropic demonstrated how AI models find breaches in smart contracts. In tests on 405 real hacked contracts, neural networks successfully attacked 207 of them, "withdrawing" $550.1 million. This is not theory: Chainalysis is already recording multiple synchronous hacking attempts, indicating automated vulnerability enumeration. The barrier to entry in hacking is rapidly falling—now, an attack often requires just a properly formulated query rather than being a Solidity expert.

The key matters more than the contract

However, the most high-profile thefts of recent years are not the result of code errors. According to Chainalysis, about 40% of all stolen funds in 2024 came from private key theft. The $1.46 billion Bybit hack in February 2025 is a striking example: attackers swapped data in the Safe interface, and signers approved an externally correct transaction. Similarly, in June 2026, Humanity Protocol lost $31 million due to malware on a developer's computer.

What works?

The answer lies not in one-off audits but in a paradigm shift in defense. The industry is moving toward MPC wallets that eliminate single points of failure, account abstraction with social recovery, and passkey authentication. A key trend is dynamic real-time threat monitoring. Systems like Forta Network or Hypernative track anomalies in the mempool before a transaction is included in a block. This approach has already proven effective: in September 2025, an automatic pause of the Venus protocol 20 minutes before a final attack saved all funds.

Web3 was designed as a system that eliminates trust in humans. But the statistics are relentless: perfect code is powerless against a phishing link opened by a developer or a dormant DAO community. It seems the main systemic vulnerability of the blockchain economy is not in algorithms but in the fact that people still sit at both ends of the wire. And as long as that remains true, security will depend not only on mathematics but also on our ability to anticipate human error.