Crypto news

In July 2026, the code of BonkDAO — the governing organization of the Solana memecoin — worked flawlessly. Despite this, approximately $20 million were withdrawn from the treasury. There was no hack in the classic sense: the vote was legitimate from a protocol standpoint.

I view this incident as a landmark signal: the industry is transitioning from an era of technical exploits to an era of exploiting human nature and governance weaknesses. This is a fundamental shift that requires a complete rethinking of the security paradigm.

Attack on decentralization

On July 6, 2026, BonkDAO faced a takeover of its decentralized governance. The attacker stole approximately 4.43 trillion BONK tokens, using not a code flaw but fundamental gaps in the DAO architecture and community passivity.

The scheme was extremely simple and elegant. Disguised as a routine initiative, Bonk Improvement Proposal #76, which supposedly involved rewarding participants, the hacker embedded a malicious function to transfer funds to their own address. To reach quorum, they spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. Against the backdrop of extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

This case exposed critical flaws: the lack of a time delay for executing decisions, too low a quorum for disposing of huge sums, and the absence of an emergency veto right for the team. A year earlier, a similar attempt was made against the Compound protocol's DAO, but that attack was successfully repelled.

Low voter turnout and token concentration are not a bug but a feature of the current governance model in Web3. Notably, as early as the beginning of 2026, Vitalik Buterin called for the development of more advanced forms of DAOs, calling the dominant token-based model "unproductive and weak."

Audit is not an indicator

While holes are being found in DAO governance without a single line of exploit code, the situation with code is paradoxical. Data from Kerberus analysts shows that 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers use long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have collectively lost over $2.8 billion — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a huge attack surface that is physically difficult to assess in its entirety.

2026 provided several illustrative examples:

1. The Truebit protocol lost $26.4 million due to an integer overflow in a legacy contract.
2. Attackers gained control of the private key of the IoTeX bridge validator and withdrew $4.4 million.
3. The largest DeFi exploit of the year was an attack on the Kelp protocol: approximately $292 million was withdrawn from the LayerZero bridge.

Prompt instead of auditor

The new adversary is AI. In December 2025, Anthropic announced the use of AI models to find vulnerabilities. During a simulation on the SCONE-bench benchmark, neural networks successfully attacked 207 of 405 actually hacked contracts, extracting $550.1 million. This lowers the barrier to entry into hacking to formulating the right prompt.

The key matters more than the contract

No audit could have prevented the largest thefts of recent years. According to Chainalysis, private key theft accounted for about 40% of all stolen funds. The $1.46 billion Bybit hack is telling, where attackers swapped data in the Safe interface. Similarly, Humanity Protocol suffered, losing $31 million due to a developer's infected computer.

The industry is responding by implementing MPC wallets, account abstraction, passkey authentication, and real-time dynamic threat monitoring. Systems like Hexagate have already proven effective, preventing an attack on Venus Protocol.

Web3 architecture was designed to eliminate trust in humans. But statistics show the opposite: perfect code is powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is people. And it seems we will have to come to terms with this.

My conclusion: we are witnessing a fundamental shift in threats. Tools for protecting against technical attacks already exist, but protection against the human factor requires changing culture and processes. Projects that do not rethink their governance and security models will have to pay a price measured in billions.