Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were drained from its treasury. There was no hack in the traditional sense: the vote was legitimate, but with catastrophic consequences.

This incident is a stark symptom of how governance attacks are becoming the new norm, and the human factor is turning into a priority target for malicious actors. At the same time, AI analysis of outdated smart contracts is becoming both a plague for cybersecurity and a universal master key for hackers.

Attack on Decentralization

On July 6, 2026, BonkDAO faced a governance takeover that resulted in the theft of approximately 4.43 trillion BONK tokens from its treasury. The attacker did not exploit the code but rather leveraged fundamental weaknesses in the DAO's architecture and community passivity, executing a transaction that was completely legal from the code's perspective.

The scheme was simple and elegant: disguised as a routine initiative, Bonk Improvement Proposal #76, which supposedly offered rewards to voters, the hacker added a malicious function that transferred treasury funds to their address. To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, these funds were enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

The attack's success exposed critical flaws in the DAO's governance system: the lack of a time delay for executing decisions, a quorum too low for managing such vast sums, and the absence of an emergency veto power for the team. The attacker carefully read the organization's charter and found a weak spot — this is not exploitation of a code bug, but a problem with the mechanisms of decentralization in Web3.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) via a malicious proposal. With typical voter turnout of 4–5%, such a package ensured control over the vote. That attack was repelled, but only through negotiations after the proposal had already been passed.

Audit Is Not a Guarantee of Security

While holes are being sought in DAO governance without a single line of exploit code, the problems with code are the opposite: technical bugs, long known but for some reason unaddressed. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding complex zero-day vulnerabilities — methods known to the industry for years were used: reentrancy errors, access control flaws, oracle manipulations, and logical errors in protocol business logic.

Cross-chain bridges are particularly vulnerable. Since 2022, they have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that specialists physically struggle to assess in its entirety.

AI — The New Adversary

While specialists were investigating recurring vulnerability patterns, they gained an adversary for whom such analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find flaws in smart contracts. In a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, the neural networks successfully attacked 207 of them, extracting a total of $550.1 million. The barrier to entry into hacking is dropping noticeably faster than the quality of defense is improving.

The Key Matters More Than the Contract

No smart contract audit could have prevented the largest thefts of the past two years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds — more than any other attack vector. The Bybit hack on February 21, 2025, is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with the process of transferring funds from a cold wallet to a hot one: in the Safe interface, signers saw tampered data and approved a seemingly correct transaction that in reality handed control of the wallet over to cybercriminals.

In June 2026, Humanity Protocol suffered a similar fate: hackers gained access to keys through a backup stored on a developer's infected computer. Losses amounted to about $31 million.

What Actually Works?

When it's not the code being hacked but the decision-making process, audits alone are insufficient. The industry is shifting its approach to storing and confirming operations: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware wallets. Protection is gradually moving from one-time checks to dynamic real-time threat monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool even before a malicious transaction is included in a block.

Web3 architecture was originally designed to completely eliminate trust in humans, handing control over to mathematics. Hack statistics demonstrate the opposite effect. Perfectly written code proves powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover.

My opinion: We are witnessing a fundamental shift in the threat landscape. An industry fixated on perfecting code has overlooked the most unreliable element of the system — the human. Until DAOs implement time-delay mechanisms and emergency vetoes, and companies move employees to hardware wallets, we will continue to pay for this mistake in the billions.