Crypto news

July 2026 became a landmark month for the entire Solana ecosystem. The code of BonkDAO, the governing organization of the eponymous memecoin, operated without a single failure, yet about $20 million evaporated from its treasury. There was no hack in the classic sense: the vote was legitimate, and the transaction was executed in full compliance with protocol rules. This is a clear signal that attacks on governance mechanisms are becoming the new norm, and the human factor is the primary target for malicious actors.

Attack on decentralization

On July 6, 2026, BonkDAO faced a governance takeover that resulted in the theft of approximately 4.43 trillion BONK tokens. The attacker did not use complex exploits—they found fundamental weaknesses in the DAO's architecture and took advantage of community passivity. Disguised as a routine initiative, Bonk Improvement Proposal #76, which supposedly involved rewarding participants, the hacker added a malicious function that transferred funds to their address.

To achieve quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. Critical system flaws—the absence of a time delay for execution, a low quorum threshold, and the lack of veto power for the team—made the attack inevitable.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. Attackers withdrew 499,000 COMP tokens (about $24.1 million) using a malicious proposal. Unlike Bonk, the attack was repelled, but only after a decision was made and through negotiations. Low turnout and token concentration are not a code error but a systemic problem of decentralization in Web3. Unsurprisingly, Vitalik Buterin, as early as the beginning of 2026, called on the community to reconsider the dominant governance model, calling it weak and vulnerable to capture.

Audit is no guarantee

While DAOs suffer from governance gaps, code demonstrates the opposite problem. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers did not seek zero-day vulnerabilities—they used long-known methods: reentrancy errors, access control issues, oracle manipulations, and logical errors in business logic.

Cross-chain bridges remain the most vulnerable. Since 2022, they have lost over $2.8 billion—about 40% of all stolen funds in Web3. The complexity of such systems creates a huge attack surface that cannot be fully assessed. 2026 showed several illustrative examples: the Truebit hack for $26.4 million due to integer overflow, an attack on the IoTeX bridge with control over a validator's private key, and the year's largest exploit—the withdrawal of $292 million from the Kelp protocol via a bridge on LayerZero.

Prompt instead of auditor

A new threat comes from artificial intelligence. In December 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, extracting $550.1 million. Already now, Chainalysis records multiple nearly identical hacking attempts on different contracts simultaneously, indicating automated vulnerability scanning. The barrier to entry into hacking is decreasing faster than the quality of protection is improving.

The key matters more than the contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis, private key theft has become the cause of about 40% of all stolen funds. The $1.46 billion Bybit hack in February 2025 is a striking example: attackers swapped data in the Safe interface, and signers approved an outwardly correct transaction. Similarly, in June 2026, Humanity Protocol suffered, losing $31 million due to a backup of keys on a developer's infected computer.

What actually works?

The industry is shifting its focus from one-time checks to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Automated systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol example demonstrated the effectiveness of this approach: the Hexagate system detected attack preparation 18 hours in advance and automatically halted the protocol 20 minutes before the final transaction.

Web3 architecture was created to eliminate trust in humans, but statistics say otherwise. Perfect code is powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy is not algorithms but people at both ends of the wire.

My comment: The industry is undergoing a painful transition from naive faith in "code as law" to understanding that security is a comprehensive process involving governance, monitoring, and the human factor. Projects that do not adapt to this new realism are doomed to repeat the fate of BonkDAO and Bybit.