Crypto news

July 2026 will be remembered by the crypto community not only for market growth, but also for a telling incident involving BonkDAO. The code of the governing organization of the Solana memecoin worked flawlessly, without a single error. Nevertheless, about $20 million was withdrawn from the treasury. This is not a hack in the classic sense — the vote was completely legitimate from a technical standpoint. We are witnessing a new trend: attacks on governance mechanisms are becoming commonplace, and the human factor and community passivity are the main vector for malicious actors.

Attack on decentralization: the takeover of BonkDAO

On July 6, 2026, BonkDAO faced a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. The attacker did not use sophisticated exploits. He acted like a careful reader of the organization's charter, finding fundamental weaknesses in it. Under the guise of a routine Bonk Improvement Proposal #76, which proposed rewarding participants, a malicious fund transfer function was added.

To reach a quorum, the hacker spent about $4.4 million, buying up one percent of the total BONK supply on centralized exchanges. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. The critical vulnerabilities were the lack of a time delay for execution, a quorum threshold that was too low for disposing of huge sums, and the absence of a veto right for the team.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) using a malicious proposal. With typical turnout of 4–5%, such a package would have been enough for control. That attack was only repelled through negotiations after the proposal had already been adopted. The problem of low turnout and token concentration is not a bug in the code, but a systemic flaw in Web3 decentralization mechanisms. Unsurprisingly, as early as the beginning of 2026, Vitalik Buterin called for a rethink of the dominant token-based governance model, calling it weak and vulnerable to capture.

Audit is no guarantee: smart contract vulnerabilities

While DAOs suffer from "social engineering," the situation with code is different. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding zero-day vulnerabilities. Attackers used long-known methods: reentrancy errors, access control errors, oracle manipulation, and logical errors in protocol business logic.

Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022 — about 40% of all stolen funds in Web3. The complexity of such systems creates a broad attack surface. 2026 provided several telling examples:

1. January 8 — the Truebit protocol lost $26.4 million due to an integer overflow in a legacy contract deployed five years earlier.
2. February 21 — attackers gained control of the private key of an IoTeX bridge validator, updated the contract to a malicious version, and withdrew $4.4 million, minting over 111 million tokens.
3. April 18 — the largest DeFi exploit of the year: about 116,500 rsETH worth $292 million were drained from the Kelp bridge on LayerZero due to a single validator and an attack on RPC infrastructure.

Even having badges from CertiK and Code4rena does not save assets. The industry needs new defense mechanisms, especially amid the development of AI.

AI as a new threat

While specialists analyze recurring patterns, an adversary has emerged for whom this analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation on the SCONE-bench benchmark (405 real-world hacked contracts), neural networks successfully attacked 207 of them, withdrawing a virtual $550.1 million. Already in June, Chainalysis specialists recorded anomalous activity — multiple nearly identical attempts to hack different contracts simultaneously, indicating automated vulnerability brute-forcing. The barrier to entry into hacking is lowering faster than the quality of defense is improving.

The key matters more than the contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft was the cause of about 40% of stolen funds. The Bybit hack on February 21, 2025, is telling, when the exchange lost $1.46 billion in ETH. Attackers replaced data in the Safe interface, and signers approved an externally correct transaction. In June 2026, Humanity Protocol suffered a similar fate, losing $31 million due to keys stored on a developer's infected computer.

So what works?

When the decision-making process is hacked rather than the code, new tools are needed. The industry is adopting MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage. Protection is shifting from one-time checks to dynamic real-time monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool. The Venus Protocol example of September 2, 2025, demonstrated effectiveness: the Hexagate system detected suspicious activity 18 hours before the attack and automatically paused the protocol 20 minutes before the final transaction, preserving funds.

Web3 architecture was designed to eliminate trust in humans by handing control to mathematics. But statistics show the opposite: perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy is not algorithms, but people at both ends of the wire.

My conclusion: we are moving toward a model where security is not a one-time audit, but an ongoing process. However, as long as the human factor remains the weak link, any technical solutions will only delay the next incident. The industry needs not only to improve code, but also to cultivate a culture of responsibility among participants.