Crypto news

July 2026 will be remembered as the moment when the code of the decentralized organization BonkDAO worked flawlessly, but this did not save its treasury. About $20 million was withdrawn without a single hack in the classic sense — the vote was completely legitimate. This incident is a striking symptom that governance attacks are becoming the new norm, and the human factor is turning into a priority target for attackers.

Attack on decentralization: legal robbery

On July 6, 2026, BonkDAO faced a governance takeover. The attacker stole approximately 4.43 trillion BONK tokens, exploiting fundamental weaknesses in the DAO architecture and community passivity. The scheme was elegant in its simplicity: disguised as a routine proposal, Bonk Improvement Proposal #76, which promised rewards to participants, a malicious function was added to the code, redirecting funds to the attacker's address.

To reach quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. The attack's success exposed critical flaws: the absence of a time delay for execution, a quorum threshold that was too low, and the team's lack of veto power.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) using a malicious proposal. With typical turnout of 4–5%, this package would have been enough for control, but the attack was repelled only after the decision was made — through negotiations. Low turnout and token concentration are not a bug in the code but a systemic problem with decentralization mechanisms in Web3. Ethereum co-founder Vitalik Buterin, as early as the beginning of 2026, called for a revision of the dominant token-governance model, calling it "weak and vulnerable to capture."

Audit is not a panacea

While DAOs are looking for holes without a single line of exploit code, the situation with code is different. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities — long-known methods were used: reentrancy errors, access control issues, oracle manipulations, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-network messages creates a broad attack surface. 2026 provided illustrative examples: the Truebit hack of $26.4 million due to integer overflow in a legacy contract, the attack on the IoTeX bridge with control over a validator's private key and the theft of $4.4 million, as well as the year's largest exploit — the withdrawal of $292 million from the Kelp protocol through a configuration with a single validator on LayerZero.

AI as a new threat and defense tool

The emergence of AI models for vulnerability discovery is radically changing the threat landscape. In December 2025, Anthropic announced the creation of the SCONE-bench benchmark consisting of 405 real hacked contracts. Neural networks successfully attacked 207 of them, extracting a simulated $550.1 million. Chainalysis analysts are already recording anomalous activity — multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability scanning. The barrier to entry into hacking is decreasing faster than the quality of defense is improving.

The key matters more than the contract

No audit would have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds — more than any other attack vector. The $1.46 billion Bybit hack in February 2025 is a striking example: attackers replaced data in the Safe interface, and signers approved an externally correct transaction, handing over control of the wallet. Similarly, in June 2026, Humanity Protocol lost $31 million due to keys stored on a developer's infected computer.

A new defense paradigm

The industry is shifting from one-time checks to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Automated systems like Forta Network and Hypernative monitor anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven its effectiveness: in September 2025, Chainalysis's Hexagate system detected preparation for an attack on Venus Protocol 18 hours in advance and automatically paused the protocol 20 minutes before the final transaction.

Web3 architecture was designed with a radical goal — to eliminate trust in humans. Hack statistics demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems that the main systemic vulnerability of the blockchain economy lies not in algorithms, but in the fact that at both ends of the wire there are still people.

My conclusion: we are witnessing a fundamental shift from "hacking code" to "hacking humans." Investors and project teams should reconsider their priorities: investing resources not only in smart contract audits but also in operational security, employee training, and emergency response mechanisms at the governance level. Otherwise, even the most perfect code will remain merely an expensive decoration.