Crypto news

July 2026. The code of BonkDAO — the governing structure of the Solana memecoin — worked flawlessly, without a single error. And yet, about $20 million disappeared from the treasury. There was no hack in the classical sense: the vote was legitimate, and the transaction was executed in full compliance with protocol rules. This is not a hacker attack; it is a systemic failure of decentralized governance.

Attack on Decentralization

On July 6, 2026, BonkDAO faced a governance takeover. The attacker withdrew approximately 4.43 trillion BONK tokens, exploiting fundamental weaknesses in the DAO's architecture and community apathy. The scheme was elegant: disguised as a routine proposal, Bonk Improvement Proposal #76, which provided rewards for voting participation, a malicious function for transferring funds to the attacker's address was embedded in the code.

To achieve quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. The system had no time-delay mechanism, the quorum was too low, and the team had no veto power. The attacker simply read the organization's charter carefully — and found a weak spot in it.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) using a malicious proposal. With a standard turnout of 4–5%, this package would have been enough for full control. That attack was repelled, but only after the proposal was passed — through negotiations. Low turnout and token concentration are not a bug in the code, but a problem with the very mechanisms of decentralization in Web3.

Audit Is Not a Guarantee of Security

According to my data, in 2025 the number of incidents in Web3 nearly halved — to ~200, down from 410 the year before. However, total losses grew from $2 billion to $2.9 billion. Chainalysis experts estimate the damage even higher — at $3.4 billion, noting that the three largest cases accounted for 69% of all losses. The gap between the largest attack and the average one was a 1000-fold magnitude — for the first time in history.

At the same time, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers were not looking for complex zero-day vulnerabilities — they used long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in protocol business logic. Cross-chain bridges are especially vulnerable: since 2022, they have lost over $2.8 billion, accounting for about 40% of all stolen funds in Web3.

2026 provided several illustrative examples:

1. Truebit (January 8): loss of $26.4 million due to an integer overflow in a legacy contract deployed five years ago. A classic error that could have been found in a re-audit.
2. IoTeX (February 21): control over a bridge validator's private key allowed updating the contract to a malicious version and withdrawing $4.4 million, minting 111 million tokens.
3. Kelp (April 18): the largest DeFi exploit of the year — $292 million from a LayerZero bridge due to a single validator and an attack on RPC infrastructure.

AI — A New Threat

While specialists analyzed recurring patterns, an adversary emerged for whom such analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. In a simulation on the SCONE-bench benchmark (405 real hacked contracts from 2020–2025), neural networks successfully attacked 207 of them, extracting $550.1 million. Even on contracts hacked after March 2025 (34 in total), the AI showed high effectiveness. In practice, this is already happening: Chainalysis records multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability scanning.

The Key Matters More Than the Contract

No audit could have prevented the largest thefts of the past two years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds — more than any other attack vector. The Bybit hack on February 21, 2025 ($1.46 billion in ETH) is a striking example: signers approved a swapped transaction in the Safe interface, handing control of the wallet to attackers. Similarly, in June 2026, Humanity Protocol lost $31 million due to keys stored on a developer's infected computer.

What Actually Works?

The industry is shifting focus from one-time checks to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are becoming the standard. Systems like Forta Network and Hypernative monitor anomalous activity in the mempool before a transaction is included in a block. The example of Venus Protocol on September 2, 2025 is telling: the Hexagate system detected suspicious activity 18 hours before the attack, and 20 minutes before the final transaction, the protocol automatically paused. Funds remained safe.

The architecture of Web3 was created to eliminate trust in humans, handing control to mathematics. But statistics show the opposite: perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover.

My comment: We are witnessing a fundamental shift in threats. The industry has outgrown the stage where security was ensured by code quality. Now the main attack vector is human psychology and decision-making processes. Projects that do not rebuild their governance and key storage systems with this in mind will have to learn from others' mistakes — or become their authors.