Crypto news

July 2026 will be remembered as the moment when decentralized governance cracked in a way that could not have been predicted algorithmically. The code of BonkDAO — the governance structure of the Solana memecoin — worked perfectly, without a single error. And yet, the treasury lost approximately $20 million. There was no hack in the classic sense: the vote was legitimate, and the transactions were verified by the network. It was a clean, methodical takeover of the decision-making process.

Attack on Trust: The BonkDAO Lesson

On July 6, an attacker exploited a fundamental weakness in DAO architecture and community apathy. Disguised as a routine improvement (BIP #76) regarding participant rewards, a malicious fund-transfer function was embedded in the proposal. To reach quorum, the hacker spent about $4.4 million, buying up 1% of the BONK supply on centralized exchanges. With low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

This case exposed a critical vacuum in security mechanisms: the lack of a time delay for executing decisions, too low a quorum threshold for managing enormous sums, and the absence of emergency veto power for the team. The attacker simply read the organization's charter more carefully than anyone else.

This is not an isolated incident. A year earlier, a similar attempt was made against the Compound protocol DAO. At that time, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million), and only prompt negotiations after the proposal was passed allowed the attack to be repelled. The problem is systemic: low turnout and token concentration are not a bug in the code, but a bug in the very concept of Web3 governance. Vitalik Buterin's criticism in early 2026 about the inefficiency of token voting proved prophetic.

Audit as Fiction: The Statistics Are Relentless

While DAOs suffer from "social engineering," classic code hacks demonstrate a different but no less alarming trend. According to my data from analytical reports, in 2025 the number of incidents in Web3 halved (to ~200), but total losses rose to $2.9 billion. Moreover, according to Chainalysis data, the damage could have reached $3.4 billion. Key takeaway: 90% of hacked smart contracts in 2025 had successfully passed an audit. Attackers are not looking for complex zero-day vulnerabilities; they exploit classic errors: reentrancy, access control issues, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost more than $2.8 billion — about 40% of all stolen funds in the industry. The complexity of cross-network communications creates an attack surface that is physically difficult to assess in its entirety. Notable examples from 2026: the Truebit hack for $26.4 million due to an integer overflow in a legacy contract, an attack on the IoTeX bridge validator with $4.4 million withdrawn, and, of course, the year's largest exploit — the attack on Kelp, where approximately 116,500 rsETH worth $292 million were drained from the LayerZero bridge.

AI as a New Threat and a Shift in the Security Paradigm

The industry faces a new challenge: artificial intelligence. In December 2025, Anthropic demonstrated that AI models are capable of finding vulnerabilities in smart contracts. During a simulation on actually hacked contracts (SCONE-bench), neural networks successfully attacked 207 out of 405, "withdrawing" $550.1 million. This means the barrier to entry for hacking is rapidly falling. Already now, Chainalysis is recording multiple synchronous attempts to hack different contracts, indicating automated vulnerability scanning rather than manual hacker work.

The Key Matters More Than the Contract

However, no audit would have saved against the largest thefts of recent years. According to Chainalysis data for 2024, private key theft was the cause of ~40% of all stolen funds. The Bybit hack for $1.46 billion in February 2025 is the most striking example. The attackers substituted data in the Safe interface, and signers approved an externally correct transaction. Similarly, in June 2026, Humanity Protocol lost $31 million due to keys stolen from a developer's infected computer.

What Actually Works?

Security is shifting from one-time checks to dynamic monitoring. The industry is adopting MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Automated systems like Forta Network or Chainalysis's Hexagate have already proven effective, preventing the Venus Protocol hack in September 2025 just 20 minutes before the final transaction.

Web3 was designed as a system that eliminates trust in humans. But the statistics show the opposite: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy is not in the algorithms, but in the people on both ends of the wire. And until this axiom is taken seriously, any technical innovation will be merely a temporary patch on a deep wound.