Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were drained from the treasury. There was no hack in the traditional sense: the vote was legitimate from a code perspective.

I break down why governance attacks are becoming the new norm, how the human factor is turning into the primary target for attackers, and why AI analysis of old smart contracts is becoming both a blessing and a curse for cybersecurity.

Attack on Decentralization

On July 6, 2026, BonkDAO faced a takeover of its decentralized governance. Approximately 4.43 trillion BONK tokens were stolen from the treasury. The attacker did not hack the code — they exploited fundamental weaknesses in the DAO's architecture and the community's passivity.

The scheme was elegant and frightening in its simplicity. Disguised as a routine initiative, Bonk Improvement Proposal #76, which supposedly rewarded voting participants, the hacker added a malicious function that transferred treasury funds to their address. To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against a backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

This case exposed critical vulnerabilities in the DAO governance system: the lack of a time-delay mechanism for executing decisions, too low a quorum for disposing of colossal sums, and the absence of emergency veto rights for the team.

This is not the first such incident. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) through a malicious proposal. With typical voter turnout of 4–5% of the total token supply, such a package would have been enough to control the vote. That attack was repelled, but only after the proposal was passed — through negotiations.

Low turnout and token concentration are not an exploitation of a code bug, but a problem with decentralization mechanisms in Web3. As early as early 2026, Vitalik Buterin called on the crypto community to develop more advanced forms of DAOs, calling the dominant token-based governance model unproductive and vulnerable to capture.

Is an Audit Not Indicative?

According to SlowMist, in 2025 the number of incidents in Web3 fell by almost half — to about 200, down from 410 the year prior. However, total losses grew from $2 billion in 2024 to $2.9 billion in 2025. Chainalysis experts estimate the damage even higher — at $3.4 billion, noting that three cases accounted for 69% of all losses.

The statistics from Kerberus analysts are telling: 90% of smart contracts hacked in 2025 had successfully passed audits. Most successful attacks did not require finding complex zero-day vulnerabilities — attackers used long-known methods:

• reentrancy errors;
• access control errors;
• oracle manipulations;
• logical errors in the protocol's business logic.

Cross-chain bridges are especially vulnerable. According to Phemex data as of April 2026, since 2022 bridges have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is physically difficult to assess in its entirety.

2026 demonstrated several telling examples: from the Truebit hack of $26.4 million due to integer overflow, to the attack on IoTeX with control over a validator's private key, and the largest DeFi exploit of the year — the withdrawal of $292 million from the Kelp bridge on LayerZero.

A Prompt Instead of an Auditor

While specialists were studying recurring patterns, they gained an adversary for whom such analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, the neural networks successfully attacked 207 of them, extracting a total of $550.1 million.

The barrier to entry into hacking is decreasing noticeably faster than the quality of defenses is improving. Just a few years ago, finding an exploitable vulnerability required an experienced Solidity specialist. Now, for a significant portion of typical attacks, the task can be reduced to formulating the right prompt.

The Key Matters More Than the Contract

No smart contract audit could have prevented the largest thefts of the past two years. According to Chainalysis data for 2024, private key theft was the cause of about 40% of stolen funds — more than any other attack vector.

The Bybit hack on February 21, 2025, is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with the process of transferring funds from a cold wallet to a hot one: in the Safe interface, signers saw substituted data and approved an outwardly correct transaction. In June 2026, Humanity Protocol suffered a similar fate: hackers gained access to keys through a backup copy on a developer's infected computer.

What Actually Works?

When the decision-making process is hacked rather than the code, audits alone are insufficient. The industry is changing its approach to storing and confirming operations: MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage.

Protection is gradually shifting from one-time checks to dynamic real-time threat monitoring. Projects are implementing automated systems like Forta Network and Hypernative, which track anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven its effectiveness: on September 2, 2025, Chainalysis's Hexagate system detected preparations for an attack on Venus Protocol 18 hours in advance and automatically paused the protocol 20 minutes before the final transaction.

Web3 architecture was designed with the goal of completely eliminating trust in humans, handing control over to mathematics. Hack statistics demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and a decentralized community sleeps during a DAO takeover.

My conclusion: the main systemic vulnerability of the blockchain economy lies not in algorithms, but in people at both ends of the wire. Until we acknowledge this fact and begin designing systems with human weakness in mind, rather than against it, any technical innovations will merely be a temporary delay before the next major hack.