Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO, the governing organization of the Solana memecoin, worked flawlessly, but about $20 million evaporated from its treasury. There was no hack in the classic sense—the vote was legitimate. This is a striking example of how attacks on governance mechanisms are becoming the new norm, and the human factor is taking the lead among attack vectors.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. The attacker did not break the code but exploited the architectural weaknesses of the DAO and the community's passivity. Disguised as a harmless proposal, Bonk Improvement Proposal #76, which provided rewards to voters, a malicious fund transfer function was embedded.

To reach a quorum, the attacker spent about $4.4 million on centralized exchanges, purchasing 1% of the BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. The system had no time-delay mechanism, the quorum was too low, and the team had no veto power.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO, aiming to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only after the proposal passed and through negotiations. The problem is obvious: low turnout and token concentration are not a bug in the code but a fundamental flaw in Web3 decentralization models. Ethereum co-founder Vitalik Buterin, as early as the beginning of 2026, criticized the dominant token-based governance model, calling it vulnerable to capture and unable to mitigate the shortcomings of human politics.

Audit Is Not a Guarantee of Security

While DAOs are being probed for holes without a single line of exploit code, the situation with code is different. According to analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not use complex zero-day vulnerabilities but employed long-known methods: reentrancy errors, access control issues, oracle manipulations, and logical errors in protocol business logic.

Cross-chain bridges are particularly vulnerable. Since 2022, they have lost over $2.8 billion—about 40% of all stolen funds in Web3. 2026 provided several telling examples: the Truebit hack of $26.4 million due to an integer overflow in a legacy contract, an attack on the IoTeX bridge with control over a validator's private key, and the year's largest exploit—the withdrawal of $292 million from the Kelp protocol due to a single cross-chain message validator.

AI as a New Tool for Hackers

The industry has faced a new adversary for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find flaws: in a simulation, neural networks successfully attacked 207 of 405 actually hacked contracts, extracting $550.1 million. By June, analysts recorded multiple nearly identical simultaneous hacking attempts on different contracts, indicating automated vulnerability scanning. The barrier to entry into hacking is lowering faster than the quality of defense is improving.

The Key Matters More Than the Contract

No audit would have prevented the largest thefts of the past two years. According to reports, private key theft accounted for about 40% of stolen funds. The Bybit hack of $1.46 billion in February 2025 is a vivid example: attackers swapped data in the Safe interface, and signers approved an outwardly correct transaction. A similar fate befell Humanity Protocol in June 2026—access to keys was gained through a backup on a developer's infected computer, with losses totaling $31 million.

What Actually Works?

The industry is shifting focus from one-time checks to dynamic monitoring. MPC wallets that eliminate a single point of failure, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Automated systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol example demonstrated effectiveness: the monitoring system detected suspicious activity 18 hours before the attack and automatically paused the protocol 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, but statistics show the opposite. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms but in the fact that humans are still at both ends of the wire. It seems this very factor will be decisive for the industry's development in the coming years.