Crypto news

July 2026. The code of BonkDAO — the governing structure of the Solana memecoin — worked flawlessly, without a single error. And yet, about $20 million evaporated from the treasury. There was no hack in the classic sense: the vote was legitimate, the transaction was executed in accordance with protocol rules. This is not a code exploit; it is an exploit of human nature.

Attack on decentralization: formal legality

On July 6, 2026, BonkDAO faced a governance takeover. The attacker siphoned off approximately 4.43 trillion BONK tokens, exploiting fundamental flaws in the DAO architecture. Disguised as a routine proposal, Bonk Improvement Proposal #76, which was supposed to reward participants, a malicious function was embedded to transfer funds to the attacker's address.

To reach quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically. The system had no timelock that would have allowed the anomalous transaction to be canceled, the quorum was ridiculously low, and the team had no veto rights.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP (~$24.1 million) using a malicious proposal. With turnout at 4–5%, the token package ensured control over the vote. That attack was only repelled through negotiations after the decision had already been made.

Low turnout and token concentration are not a bug but a systemic problem of governance tokenomics in Web3. Vitalik Buterin, back in early 2026, rightly called the dominant DAO model "unproductive and vulnerable to capture," calling for a complete overhaul of the concept.

Audit as fiction: 90% of hacked contracts were audited

While DAOs search for holes without a single line of exploit, the situation with code is paradoxical. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not hunt for zero-day vulnerabilities — they used methods known for years: reentrancy errors, access control issues, oracle manipulations, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-network messaging creates a huge attack surface that is physically difficult to assess in its entirety. Notable examples from 2026:

1. Truebit (January 8): loss of $26.4 million due to an integer overflow in a legacy contract deployed five years ago. A classic error that would have been found in a re-audit after an update.
2. IoTeX (February 21): control over the bridge validator's private key allowed the contract to be updated to a malicious version and $4.4 million to be withdrawn, minting over 111 million tokens.
3. Kelp (April 18): the largest DeFi exploit of the year — $292 million from a LayerZero bridge. The cause: a single validator for cross-chain messages and an attack on RPC infrastructure.

Badges from CertiK and Code4rena did not protect the assets. The industry needs new defense mechanisms.

AI as a master key: a prompt instead of an auditor

While specialists studied recurring patterns, they gained an adversary for whom analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities. On the SCONE-bench benchmark of 405 real hacked contracts, neural networks successfully attacked 207, extracting a simulated $550.1 million. Even on 34 contracts hacked after March 2025, the AI showed high effectiveness.

In practice, this is already happening. In June, Chainalysis recorded multiple nearly identical attempts to hack different contracts simultaneously — automated vulnerability scanning that is beyond human capability. The barrier to entry into hacking is lowering faster than the quality of defense is rising.

The key matters more than the contract

No audit would have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft is the cause of about 40% of all stolen funds. The Bybit hack ($1.46 billion in ETH) is the clearest example: attackers swapped data in the Safe interface, and signers approved an externally correct transaction. In June 2026, Humanity Protocol lost $31 million due to keys stored on a developer's infected computer.

The industry is shifting toward dynamic protection: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Monitoring systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol example showed that an automatic pause 20 minutes before the final attack saved the funds.

My comment: We are building an economy on mathematics, but we forget that there are people at both ends of the wire. Until the industry solves the problem of the human factor — whether it is DAO passivity or a phishing link — any audits and formal checks will remain merely cosmetic solutions. Perfect code is powerless against a perfectly foolish action.