Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO — the governing body of the Solana memecoin — worked flawlessly, yet about $20 million evaporated from the organization's treasury. There was no hack in the classic sense: the vote was legitimate, but it became a tool for theft.

I break down why attacks on governance mechanisms are becoming the new norm, how the human factor is turning into a priority target for attackers, and why AI analysis of outdated smart contracts is simultaneously becoming both a threat and a "master key" for cybercriminals.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a takeover of its decentralized governance, resulting in the withdrawal of approximately 4.43 trillion BONK tokens from the treasury. The attacker exploited fundamental flaws in the DAO's architecture and community passivity, executing a transaction that was completely legal from the code's perspective.

The scheme unfolded as follows: disguised as a routine initiative, Bonk Improvement Proposal #76, which proposed rewards for voting participants, the hacker embedded a malicious function that provided for transferring funds to his address. To reach a quorum, he spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. Against a backdrop of extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

The incident exposed critical flaws in the DAO's governance system: the lack of a time delay for executing decisions, too low a quorum for disposing of large sums, and the absence of an emergency veto right for the team. The attacker carefully studied the organization's charter and found a weak spot.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) via a malicious proposal. With typical turnout of 4–5% of the total supply, that package would have been enough to seize control. That attack was repelled, but only after the proposal was passed and through negotiations.

Low turnout and token concentration are not a code exploit but a problem with the very mechanisms of decentralization in Web3. Unsurprisingly, in early 2026, Ethereum co-founder Vitalik Buterin called on the community to develop more advanced forms of DAOs, calling the dominant token model unproductive and vulnerable to capture.

Audit Is Not a Guarantee of Security

While holes are being sought in DAO governance without a single line of exploit code, the issues with code are different: technical bugs that have long been known but for some reason were not identified in advance. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities — methods known to the industry for years were used:

• reentrancy errors;
• access control errors;
• oracle manipulations;
• logical errors in the protocol's business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a vast attack surface that is difficult to assess in its entirety.

2026 provided several telling examples: the Truebit hack for $26.4 million due to integer overflow, an attack on the IoTeX bridge validator with the withdrawal of $4.4 million and the minting of 111 million tokens, as well as the largest DeFi exploit of the year — an attack on the Kelp protocol, where approximately 116,500 rsETH worth $292 million were withdrawn from the LayerZero bridge. The incident was made possible by a single cross-chain message validator and an attack on LayerZero's RPC infrastructure.

Prompt Instead of Auditor

While specialists were studying recurring patterns, an adversary emerged for whom such analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation on the SCONE-bench benchmark (405 actually hacked contracts), neural networks successfully attacked 207 of them, extracting $550.1 million. Even on contracts hacked after March 2025, the AI showed high effectiveness.

In practice, this is already happening: Chainalysis records multiple nearly identical hacking attempts on different contracts simultaneously, indicating automated vulnerability enumeration. The entry barrier to hacking is lowering faster than the quality of protection is improving.

The Key Matters More Than the Contract

No smart contract audit could have prevented the largest thefts of the past two years. According to Chainalysis data for 2024, private key theft was the cause of about 40% of stolen funds. The Bybit hack in February 2025 ($1.46 billion in ETH) is a striking example: signers in the Safe interface saw substituted data and approved an outwardly correct transaction. Similarly, in June 2026, Humanity Protocol suffered, losing $31 million due to key access through a developer's infected computer.

What Actually Works?

The industry is changing its approaches: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Protection is shifting from one-time checks to dynamic real-time threat monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol example in September 2025 demonstrated effectiveness: the attack was prevented 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, but statistics show the opposite. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy lies not in algorithms but in people at both ends of the wire.

My expertise: the industry is undergoing a fundamental shift — from protecting code to protecting processes and people. Projects that do not integrate real-time monitoring and do not revisit governance models risk becoming the next victims. The question is not whether attacks will happen, but how quickly the industry adapts to the new reality.