Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were drained from the treasury. There was no hack in the traditional sense: the vote was legitimate from a code perspective.

This is a striking example of how governance attacks are becoming the new norm. The human factor is turning into the primary attack vector, while AI analysis of old smart contracts is simultaneously becoming both a threat and a tool for malicious actors.

Attack on decentralization

On July 6, 2026, BonkDAO faced a governance takeover. The attacker exploited fundamental weaknesses in the DAO's architecture and community passivity. Disguised as a routine initiative, Bonk Improvement Proposal #76, which proposed participant rewards, the hacker added a malicious function to transfer funds to their own address.

To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

The attack's success exposed critical flaws: the absence of a time delay for execution, a low quorum threshold, and the team's lack of veto power. This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO, but it was successfully repelled.

Low turnout and token concentration are not an exploit but a problem with decentralization mechanisms. Unsurprisingly, Vitalik Buterin, as early as the beginning of 2026, called for a rethink of the dominant token-based governance model, labeling it vulnerable to capture.

Audit is not a guarantee

While DAOs search for holes without a single line of exploit code, the opposite problem exists with code. According to data from Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers use methods known for years: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are particularly vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a huge attack surface that is difficult to assess in its entirety.

2026 provided illustrative examples: the Truebit hack of $26.4 million due to integer overflow, an attack on the IoTeX bridge through control of a validator's private key ($4.4 million), and the year's largest exploit — the withdrawal of $292 million from the Kelp protocol through a single cross-chain message validator.

Prompt instead of auditor

A new adversary — AI. In December 2025, Anthropic announced that its models were able to attack 207 out of 405 real-world hacked smart contracts within the SCONE-bench benchmark, extracting $550.1 million. This lowers the barrier to entry for hacking: for typical attacks, it is now enough to correctly formulate a prompt.

Chainalysis is already recording multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability scanning.

The key matters more than the contract

No audit would have prevented the largest thefts. According to Chainalysis data, private key theft accounted for about 40% of stolen funds. The Bybit hack of $1.46 billion is a striking example: signers approved a swapped transaction in the Safe interface. Similarly, Humanity Protocol suffered in June 2026, losing $31 million due to keys stored on a developer's infected computer.

What actually works?

The industry is shifting from one-off checks to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Systems like Forta Network and Hypernative monitor mempool activity for anomalies before a transaction is included in a block.

The proactive response model is already working: in September 2025, Chainalysis's Hexagate system detected suspicious activity 18 hours before an attack on the Venus protocol and automatically paused the protocol 20 minutes before the final transaction. Funds remained safe.

Web3 architecture was designed to eliminate trust in humans, transferring control to mathematics. Statistics show the opposite effect. Perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy lies not in algorithms, but in the fact that there are still people at both ends of the wire.

My conclusion: the industry is moving from the "protect the code" paradigm to the "protect the process" paradigm. But until we solve the problem of human apathy in governance and create real checks and balances, any technological solutions will only be temporary patches.