The human factor is the main vulnerability of Web3: an analysis of attacks on governance and infrastructure
July 2026 became a landmark month for the industry: the code of BonkDAO, the governance structure of the Solana memecoin, ran without a single error, yet about $20 million leaked from the organization's treasury. There was no hack in the classic sense—the vote was legitimate. This is a striking example of how attacks on governance mechanisms are becoming the new norm, and the human factor is turning into the primary vector for malicious actors.
Seizing Decentralization: How It Works
On July 6, 2026, BonkDAO faced a governance takeover. The attacker stole approximately 4.43 trillion BONK tokens, exploiting fundamental flaws in the DAO's architecture and community apathy. The transaction was completely legal from the code's perspective.
The attack scheme looked like this: disguised as a routine proposal, Bonk Improvement Proposal #76, which promised rewards to voters, the hacker embedded a malicious function that transferred funds to his address. To reach quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. That was enough to control nearly 100% of the votes amid extremely low turnout. Six days later, the proposal executed automatically.
The incident exposed critical shortcomings: the absence of a time delay for executing decisions, a low quorum threshold, and the team's lack of veto power. The attacker carefully studied the organization's charter and found a weak spot.
This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) using a malicious proposal. With typical turnout of 4-5% of the total token supply, that package would have been enough to seize control. That attack was only repelled after the proposal passed, through negotiations.
The problem is not the code but the mechanisms of decentralization themselves. Unsurprisingly, Ethereum co-founder Vitalik Buterin called in early 2026 for a redesign of DAOs, calling the dominant token-based governance model "weak" and "vulnerable to capture."
Audit Is Not a Panacea
While DAOs search for holes without a single line of exploit code, the situation with code is different. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities—long-known methods were used: reentrancy errors, access control issues, oracle manipulations, and logical errors in business logic.
Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion—about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is difficult to assess in its entirety.
2026 provided several telling examples:
- On January 8, the Truebit protocol lost $26.4 million due to an integer overflow in a legacy contract deployed five years earlier.
- On February 21, attackers gained control of the private key of the IoTeX bridge validator and withdrew $4.4 million, minting over 111 million tokens.
- On April 18, the largest DeFi exploit of the year was the attack on the restaking protocol Kelp: about 116,500 rsETH worth $292 million were drained from the LayerZero bridge. The cause was a configuration with a single validator for cross-chain messages.
AI in the Service of Hackers
New attack vectors require a restructuring of defense. However, defenders now face an adversary for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced that AI models successfully attacked 207 of 405 real-world hacked smart contracts, extracting $550.1 million in simulation. This confirms: the barrier to entry into hacking is lowering faster than the quality of defense is improving.
The Key Matters More Than the Contract
No audit could have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds. The Bybit hack in February 2025 is telling, when the exchange lost $1.46 billion in ETH. Attackers tampered with data in the Safe interface, and signers approved an outwardly correct transaction, handing over control of the wallet. In June 2026, Humanity Protocol suffered a similar fate, losing $31 million due to a backup of keys on a developer's infected computer.
What Works?
The industry is shifting from one-off checks to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Automated systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven itself: in September 2025, Chainalysis's Hexagate system detected preparations for an attack on the Venus protocol 18 hours in advance and automatically paused it 20 minutes before the final transaction.
Web3 architecture was designed to eliminate trust in humans, handing control to mathematics. Reality demonstrates the opposite: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms but in the fact that people are still at both ends of the wire.
My conclusion: the industry must acknowledge that technical audits are merely a basic hygiene minimum. True security requires a comprehensive approach, including behavioral analysis, real-time monitoring, and, more importantly, a reconsideration of the very philosophy of governance, which should account for human nature rather than ignore it.