Crypto news

July 2026 will be remembered by the crypto community not only for market growth, but also for a landmark incident that exposed fundamental problems in decentralized governance. This refers to BonkDAO, where, despite flawless code operation, approximately $20 million was withdrawn from the treasury. This is not a hack in the classic sense — the vote was completely legitimate from a technical standpoint.

This case is not an isolated error, but a symptom of a systemic crisis. We are witnessing attacks on governance mechanisms becoming the "new normal," with the human factor turning into the primary target for malicious actors. At the same time, a new player is emerging on the scene — artificial intelligence, which is radically changing the rules of the game in cybersecurity.

Attack on Decentralization: Anatomy of a Takeover

On July 6, 2026, BonkDAO faced a governance takeover. The attacker, exploiting fundamental weaknesses in the DAO's architecture and community passivity, stole approximately 4.43 trillion BONK tokens. The scheme was painfully simple and effective. Disguised as a routine initiative to reward voting participants (BIP #76), a malicious condition for transferring funds was added to the code.

To reach quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total supply. Against the backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. The system had neither a time-delay mechanism nor emergency veto rights, making the attack irreversible.

This is not the first such case. A year earlier, a similar attempt was made against Compound, where with a turnout of 4-5%, attackers tried to withdraw $24.1 million. That attack was repelled, but only after the fact and through negotiations. The problem is obvious: low turnout and token concentration are not a code exploit, but a breach in the very mechanisms of Web3 decentralization. Ethereum co-founder Vitalik Buterin has long warned about this, calling for the creation of more advanced forms of DAOs.

Audit — Not a Guarantee of Security

While DAOs suffer from governance gaps, the situation with code is no less alarming. According to analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks used methods known for years: reentrancy errors, access control issues, oracle manipulation, and logic errors. Cross-chain bridges are particularly vulnerable, having lost over $2.8 billion since 2022 — about 40% of all stolen funds in Web3.

2026 showed a diversity of attack vectors: from integer overflow in Truebit ($26.4 million) and compromise of IoTeX validator keys ($4.4 million) to the year's largest exploit — the attack on the Kelp protocol, where $292 million was drained due to a single validator and an attack on RPC infrastructure. CertiK and Code4rena badges failed to protect assets.

AI: A New Threat and a New Tool

While specialists were analyzing recurring patterns, an adversary emerged for whom such analysis is a routine task. In December 2025, Anthropic announced the use of AI to find vulnerabilities. During a simulation, neural networks successfully attacked 207 of 405 actually hacked contracts, draining $550.1 million. This means the barrier to entry into hacking is rapidly falling. For typical attacks, it is now enough to properly formulate a query to an LLM.

The Key Matters More Than the Contract

However, no audit would have prevented the largest thefts of recent years. According to Chainalysis, private key theft is the cause of about 40% of all stolen funds. The $1.46 billion Bybit hack is a striking example, where data substitution in the Safe interface led to approval of a malicious transaction. A similar situation occurred with Humanity Protocol, where keys were stolen via a developer's infected computer.

The industry is responding, shifting from one-off checks to dynamic monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol example demonstrated the effectiveness of this approach: an attack was prevented 20 minutes before the final transaction.

Web3 architecture was created with the goal of eliminating trust in humans. But the statistics are relentless: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not algorithms, but people at both ends of the wire. Until we acknowledge this fact, any technological innovations will be merely temporary patches.