Crypto news

The code of BonkDAO — the governing structure of the Solana memecoin — operated flawlessly in July 2026. Nevertheless, about $20 million leaked from the organization's treasury. This was not a classic hacker attack with an exploit, but a transaction that was legitimate from the code's perspective, approved by a real vote. We are witnessing a troubling trend: attacks on governance mechanisms are becoming commonplace, and the human factor is turning into the preferred vector for malicious actors.

Governance Takeover: Anatomy of the BonkDAO Attack

On July 6, 2026, BonkDAO suffered a takeover of its decentralized governance. The attacker siphoned off approximately 4.43 trillion BONK tokens, exploiting fundamental flaws in the DAO's architecture and community apathy. Disguised as a routine proposal, Bonk Improvement Proposal #76 regarding participant rewards, the hacker embedded a malicious function redirecting funds to their address.

To reach quorum, they spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed. Critical vulnerabilities included the lack of a time-delay mechanism for executing decisions, an excessively low quorum threshold, and the absence of a team veto right.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million), but the attack was repelled after the proposal was adopted through negotiations. Low turnout and token concentration are not a bug in the code, but a systemic problem with decentralization mechanisms in Web3.

Audits Do Not Guarantee Security

While DAOs search for holes without a single line of exploit code, the situation with code is different. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks used long-known methods: reentrancy errors, access control issues, oracle manipulations, and logical errors in the protocol's business logic.

Cross-chain bridges are of particular concern. Since 2022, they have lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is physically difficult to assess in its entirety.

2026 demonstrated several attack vectors: from integer overflow in an outdated Truebit contract ($26.4 million) to the compromise of a private key of the IoTeX bridge validator ($4.4 million) and the year's largest exploit — an attack on the Kelp protocol with a $292 million withdrawal due to a single validator, as well as an attack on LayerZero's RPC infrastructure.

AI as a New Threat

A new adversary is emerging for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find flaws in smart contracts. During a simulation on the SCONE-bench benchmark, neural networks successfully attacked 207 out of 405 real-world hacked contracts, extracting $550.1 million. The barrier to entry for hacking is decreasing faster than the quality of defense is improving.

The Key Matters More Than the Contract

No audit would have prevented the largest thefts of recent years. Private key theft accounted for about 40% of stolen funds. The $1.46 billion Bybit hack in February 2025 and the attack on Humanity Protocol in June 2026 ($31 million) are vivid examples of compromised decision-making processes, not code.

What Works?

The industry is shifting its focus to dynamic monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol case demonstrated effectiveness: the Hexagate system detected suspicious activity 18 hours before the attack and automatically paused the protocol 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, but statistics show the opposite. Perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in algorithms, but in the fact that there are still humans at both ends of the wire.

My comment: We are entering an era where Web3 security is determined not by code quality, but by the resilience of human processes and the speed of automated response. Projects that do not invest in real monitoring and do not rethink governance models will become the next easy prey.