Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were withdrawn from the treasury. No one hacked anything in the conventional sense: the vote was real.

Attack on decentralization

On July 6, 2026, BonkDAO faced a takeover of its decentralized governance, resulting in the theft of approximately 4.43 trillion BONK tokens from the treasury. The attacker exploited fundamental weaknesses in the DAO's architecture and community passivity, executing a transaction that was legitimate from the code's perspective.

The attack scheme was as follows: disguised as a routine initiative, Bonk Improvement Proposal #76, which supposedly rewarded voting participants, the hacker added a malicious function that provided for transferring funds from the treasury to his address. To ensure a successful vote, the attacker spent about $4.4 million on centralized exchanges, buying up one percent of the total BONK supply needed to reach a quorum. Against the backdrop of extremely low turnout, these funds were enough to control nearly 100% of the votes. After six days, the proposal executed automatically.

The successful attack revealed critical vulnerabilities in the DAO's governance system. There was no time-delay mechanism for executing decisions that would have given developers time to cancel the anomalous transaction. Additionally, the quorum for disposing of colossal sums turned out to be too low, and the team had no emergency veto rights.

This is not the first such case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million at the exchange rate at the time of the incident) from the protocol's treasury using a malicious improvement proposal. With typical turnout in the organization of 4–5% of the total token supply, such a package proved sufficient to gain control over the vote. Unlike the Bonk case, that attack was noticed and repelled, but only after the proposal was adopted — through negotiations.

Is an audit not an indicator?

While holes are being sought in DAO governance without a single line of exploit code, the problems with code are the opposite: the bugs are technical and long-known — they just weren't warned about in advance for some reason. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most successful attacks did not require finding complex zero-day vulnerabilities — attackers used methods known to the industry for years:

• reentrancy errors — launching a function again before the previous call completes;
• access control errors — when a security-critical function is accessible to a wider circle of people than it should be;
• oracle manipulation — distorting asset price data that the smart contract relies on;
• logical errors in the protocol's own business system that scanners do not detect.

Cross-chain bridge protocols need high-quality code reviews more than others. According to Phemex data as of April 2026, since 2022 bridges have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The point is that the complexity of cross-chain messaging creates a broad attack surface that specialists physically find difficult to assess in its entirety: a large number of independent components must work in parallel, and it is enough to make a mistake in just one of them.

Prompt instead of auditor

While specialists were researching recurring vulnerability patterns, they gained an adversary for whom such analysis is a routine task solved at a speed unattainable for any team of human experts. On December 1, 2025, Anthropic announced the use of AI models to find holes in smart contracts and discovered new exploits totaling $4.6 million. For testing, programmers assembled the SCONE-bench benchmark, consisting of 405 smart contracts actually hacked between 2020 and 2025. During the simulation, neural networks managed to successfully attack 207 of them, withdrawing a total of $550.1 million.

In practice, this is already happening. In June, Chainalysis specialists reported that they had recorded anomalous activity in networks — multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability enumeration rather than manual work by an individual hacker.

The key matters more than the contract

No smart contract audit could have prevented the largest thefts of the last two years. According to Chainalysis's 2024 report, private key theft accounted for about 40% of stolen funds — more than any other single attack vector, including smart contract vulnerabilities.

The Bybit hack is telling in this regard. On February 21, 2025, the exchange lost $1.46 billion in ETH, making it the largest single theft in the history of the crypto industry. The attackers interfered with the process of a routine transfer of funds from a cold wallet to a hot one: in the Safe interface, signers saw substituted data and approved an externally correct transaction that in reality transferred control of the wallet to cybercriminals. In June 2026, Humanity Protocol suffered a similar fate: the hackers gained access to keys through a backup copy stored on a developer's computer infected with malware. Losses amounted to about $31 million.

What actually works?

When it is not the code that is hacked but the decision-making process, smart contract audits alone are no longer sufficient. Therefore, the industry is changing both tools and the very approach to storing and confirming operations: MPC wallets, account abstraction with a social recovery access mechanism, passkey authentication, and the use of hardware and cold crypto wallets. Protection is gradually shifting from one-time checks to dynamic real-time threat monitoring. Projects are implementing automated systems like Forta Network and Hypernative, which track anomalous activity in the mempool even before a malicious transaction is included in a block.

The proactive response model has already proven its effectiveness in practice. On September 2, 2025, when attackers attempted to attack the Venus lending protocol, Chainalysis's Hexagate monitoring system detected the deployment of a suspicious smart contract and anomalous activity 18 hours before the main phase of the attack. Twenty minutes before the final transaction that was supposed to drain the pools, the protocol automatically paused. The funds remained safe, and the hackers wasted resources on gas fees.

Web3 architecture was originally designed with a radical goal — to completely eliminate trust in humans by transferring control to immutable mathematics. The hacking statistics of recent years demonstrate the opposite effect. Perfectly written and double-checked code turns out to be absolutely powerless if a developer clicks a phishing link, and a decentralized community sleeps during a DAO takeover. Perhaps the main systemic vulnerability of the blockchain economy lies not in algorithms at all, but in the fact that at both ends of the wire there are still people?

My conclusion: the industry is undergoing a fundamental paradigm shift. We are accustomed to trusting code, but the reality is that the most costly mistakes are made outside the blockchain — in interfaces, processes, and human decisions. Until projects integrate multi-layered protection, including real-time monitoring and hardware solutions, the vulnerability will persist. This is not a question of "if," but a question of "when" the next major theft will occur.