Crypto news

July 2026 became a landmark month for the entire decentralized finance ecosystem. The code of BonkDAO — the governance structure of the popular Solana memecoin — worked flawlessly, without a single error. However, this did not prevent attackers from draining approximately $20 million from the treasury. There was no hack in the classic sense: the vote was legitimate, and the transaction was executed in full compliance with the code.

This incident is a vivid illustration of how governance attacks are becoming the new norm, and the human factor is turning into the primary attack vector. At the same time, the development of AI is opening new horizons for hackers, enabling the automation of vulnerability discovery in legacy smart contracts.

Seizing Decentralization: Anatomy of the BonkDAO Attack

On July 6, 2026, BonkDAO faced an unprecedented governance takeover. The attacker, exploiting fundamental weaknesses in the DAO's architecture and community passivity, stole approximately 4.43 trillion BONK tokens. The scheme was simple and elegant: disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly involved rewarding participants, a malicious fund transfer function was added.

To reach quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. There were several critical vulnerabilities: the lack of a time delay for executing decisions, too low a quorum, and the absence of a veto right for the team.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million), and only through negotiations after the proposal was passed was the attack thwarted. Low turnout and token concentration are not a code error but a systemic problem with decentralization mechanisms in Web3. As early as the beginning of 2026, Vitalik Buterin called for a rethink of the dominant token-based governance model, calling it vulnerable to capture and inefficient.

Audit Is Not a Panacea

While governance loopholes are being sought without a single line of exploit code, code-related issues are of a different nature. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities — known methods were used: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.

The security issue of cross-chain bridges is particularly acute. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is difficult to assess in its entirety. Examples from 2026 are telling: the Truebit hack for $26.4 million due to an integer overflow in a legacy contract, the attack on the IoTeX bridge with control over a validator's private key ($4.4 million), and the year's largest exploit — the attack on Kelp, where $292 million in rsETH was drained from the LayerZero bridge.

AI as a New Attack Tool

While specialists studied recurring patterns, an adversary emerged for whom analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find vulnerabilities. In a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, extracting $550.1 million. In practice, this is already happening: Chainalysis records multiple simultaneous hacking attempts on different contracts, indicating automated vulnerability scanning. The barrier to entry into hacking is lowering faster than the quality of defense is improving.

The Key Matters More Than the Contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds. The Bybit hack on February 21, 2025, when the exchange lost $1.46 billion in ETH, is a striking example. Attackers replaced data in the Safe interface, and signers approved an externally correct transaction. Similarly, in June 2026, Humanity Protocol suffered ($31 million) — keys were stolen via a developer's infected computer.

What Works?

The industry is changing its approaches: MPC wallets that eliminate a single point of failure are being implemented, along with account abstraction with social recovery and passkey authentication to combat phishing. Protection is shifting from one-off checks to dynamic real-time threat monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol example is telling: the Hexagate system detected attack preparation 18 hours in advance, and the protocol automatically paused 20 minutes before the final transaction.

Web3 was designed to eliminate trust in humans, but statistics demonstrate the opposite. Perfectly written code is powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms but in the fact that there are still people on both ends of the wire.

My comment: The industry is undergoing a fundamental shift — from protecting code to protecting processes and people. Until projects realize that security is not a one-time audit but continuous monitoring and multi-layered protection, we will witness increasingly sophisticated attacks on human nature.