Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO, the governing organization of the Solana memecoin, worked flawlessly, yet approximately $20 million disappeared from its treasury. There was no hack in the classic sense—the vote was legitimate. This is a striking example of how attacks on governance mechanisms are becoming the new norm, and the human factor is turning into the primary target for malicious actors.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. Exploiting weaknesses in the DAO's architecture and community passivity, the attacker executed a transaction that was legitimate from a code perspective. Disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly offered rewards to voters, the hacker embedded a malicious function to transfer funds to their own address.

To reach quorum, the attacker spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. Critical system vulnerabilities included: the absence of a time delay for executing decisions, too low a quorum threshold, and the lack of emergency veto rights for the team.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO, when attackers tried to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only after the proposal was passed, through negotiations. The problem of low turnout and token concentration is not a bug in the code but a fundamental flaw in Web3 decentralization mechanisms.

Audit Is Not a Guarantee of Security

2025 statistics show a troubling trend: the number of Web3 incidents nearly halved (to ~200), but total losses rose from $2 billion to $2.9 billion. According to Chainalysis, the damage reached $3.4 billion, with the three largest attacks accounting for 69% of all losses.

Kerberus analysts uncovered a shocking fact: 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not seek complex zero-day vulnerabilities but used long-known methods: reentrancy errors, access control flaws, oracle manipulations, and logical errors in protocol business logic.

Cross-chain bridges are of particular concern. Since 2022, they have lost over $2.8 billion—about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is difficult to fully assess.

2026 demonstrated a diversity of attack vectors: from an integer overflow in Truebit ($26.4 million) to control over the private key of the IoTeX bridge validator ($4.4 million) and the year's largest DeFi exploit against the Kelp protocol ($292 million). The latter was made possible due to a configuration with a single validator and an attack on LayerZero's RPC infrastructure.

AI—The New Weapon of Hackers

While specialists studied recurring patterns, an adversary emerged for whom such analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. In a simulation on the SCONE-bench benchmark (405 real hacked contracts), neural networks successfully attacked 207 of them, extracting $550.1 million. This confirms that the barrier to entry into hacking is lowering faster than the quality of defenses is improving.

The Key Matters More Than the Contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft was the cause of about 40% of stolen funds. Notable examples include the Bybit hack in February 2025 ($1.46 billion), where attackers swapped data in the Safe interface, and the Humanity Protocol incident in June 2026 ($31 million), where keys were stolen via a developer's infected computer.

What Actually Works?

The industry is changing its approach to security: MPC wallets that eliminate a single point of failure, account abstraction with social recovery, passkey authentication, and hardware wallets are being adopted. Protection is shifting from one-time checks to dynamic real-time monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven effective: in September 2025, the Hexagate system prevented an attack on Venus Protocol by automatically pausing the protocol 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, but statistics demonstrate the opposite. Perfectly written code is powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in the algorithms but in the fact that there are still humans at both ends of the wire.

My conclusion: the industry must acknowledge that technological perfection does not solve the problem of human error. We need hybrid systems that combine cryptographic security with social control mechanisms and behavioral analysis. Only such an approach can counter the new generation of threats, where AI is becoming a universal master key.