Crypto news

July 2026 became a landmark month for the security of decentralized finance. The code of BonkDAO — the governing structure of the Solana-based memecoin — worked flawlessly, yet this did not prevent attackers from draining approximately $20 million from its treasury. This was not a hack in the classic sense: the vote was completely legitimate from a technical standpoint.

This incident is a striking illustration of how governance attacks are becoming a standard tool for hackers, and the human factor is turning into their main ally. Moreover, AI analysis of outdated smart contracts today serves as both a threat and a master key for cybercriminals.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens from its treasury. The attacker exploited fundamental weaknesses in the DAO's architecture and community passivity, executing a transaction that fully complied with the code.

The scheme was almost banal in its simplicity: disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly offered rewards to voters, the hacker embedded a malicious function to transfer funds to their own address. To reach quorum, they spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

This case exposed critical flaws in DAO governance systems: the lack of a time-delay mechanism for executing decisions, a quorum set too low for managing enormous sums, and the absence of emergency veto rights for the team.

A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) via a malicious proposal. With typical voter turnout of 4–5% of the total token supply, that package would have been enough for full control. That attack was only repelled after the proposal passed — through negotiations.

Low turnout and token concentration are not exploitation of a code bug but a systemic problem of decentralization mechanisms in Web3. Unsurprisingly, as early as early 2026, Ethereum co-founder Vitalik Buterin called on the community to develop more advanced forms of DAOs, calling the dominant token-based governance model "unproductive and weak" and vulnerable to capture.

Audit Is No Guarantee of Security

According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding complex zero-day vulnerabilities — attackers used long-known methods:

• reentrancy errors;
• access control errors;
• oracle manipulation;
• logical errors in protocol business logic.

Cross-chain bridges are of particular concern. Since 2022, they have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a huge attack surface that specialists physically struggle to assess in its entirety.

2026 provided several telling examples: the Truebit hack for $26.4 million due to integer overflow, the IoTeX bridge attack with control over a validator's private key, and the largest DeFi exploit of the year — the withdrawal of about 116,500 rsETH worth $292 million from the Kelp protocol via a bridge on LayerZero.

Prompt Instead of Auditor

While specialists were studying recurring patterns, they gained an adversary for whom such analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. In a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, extracting a total of $550.1 million.

In practice, this is already happening: Chainalysis specialists are recording multiple nearly identical hacking attempts on different contracts simultaneously, indicating automated vulnerability scanning. The barrier to entry into hacking is dropping noticeably faster than the quality of defenses is improving.

The Key Matters More Than the Contract

No smart contract audit could have prevented the largest thefts of the past two years. According to Chainalysis, private key theft accounted for about 40% of all stolen funds — more than any other attack vector.

The Bybit hack in February 2025 is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with the fund transfer process by substituting data in the Safe interface. Signers approved an outwardly correct transaction that in reality handed control of the wallet to cybercriminals. Similarly, in June 2026, Humanity Protocol suffered, losing about $31 million due to key access through a developer's infected computer.

What Actually Works?

When the decision-making process is hacked rather than the code, audits alone are insufficient. The industry is shifting focus to:

• MPC wallets that eliminate a single point of failure;
• account abstraction with social recovery;
• passkey authentication to counter phishing;
• hardware and cold wallets instead of software solutions.

Protection is gradually moving from one-off checks to dynamic real-time threat monitoring. Projects are implementing automated systems like Forta Network and Hypernative, which track anomalous activity in the mempool before a transaction is included in a block. This model has already proven effective: in September 2025, Chainalysis's Hexagate system detected preparation for an attack on the Venus protocol 18 hours before the main phase, allowing it to be automatically stopped 20 minutes before the final transaction.

Web3 architecture was designed with a radical goal — to eliminate trust in humans by handing control to mathematics. Hack statistics demonstrate the opposite effect. Perfectly written code proves powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms but in the fact that there are still humans at both ends of the wire.

My conclusion: the industry is undergoing a fundamental paradigm shift. We are used to trusting code, but real threats lie in the realm of social engineering and governance processes. Projects that fail to rethink their security models with the human factor in mind will pay a very high price for that mistake.