Crypto news

July 2026 became a landmark month for decentralized finance security. The code of BonkDAO — the governing body of the popular memecoin on Solana — worked flawlessly, but that did not stop attackers from siphoning off about $20 million from the treasury. There were no typical hacks: the vote was legitimate, and the attack was carried out "within the rules."

This incident is just the tip of the iceberg. The industry has faced a new reality where governance attacks are becoming routine, and the human factor is the primary target for hackers. At the same time, artificial intelligence capable of analyzing old smart contracts is turning into a universal master key for attackers and, simultaneously, a serious problem for cybersecurity.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. The attacker exploited fundamental weaknesses in the DAO's architecture and community passivity, executing a transaction that was legal from the code's perspective.

The scheme was simple and effective. Disguised as a routine proposal, Bonk Improvement Proposal #76, which supposedly rewarded voters, the hacker embedded a malicious function to transfer funds to their own address. To reach a quorum, they spent about $4.4 million on centralized exchanges, purchasing 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

The attack exposed critical flaws in the governance system: the lack of a time delay for executing decisions, a quorum too low for managing large sums, and the absence of an emergency veto right for the team. The attacker simply read the organization's charter carefully and found a weak spot.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (about $24.1 million) through a malicious proposal. With typical voter turnout of 4–5%, that package would have been enough to control the vote. That attack was repelled, but only after the proposal was passed, through negotiations.

The problem is not code errors but the mechanisms of decentralization themselves. Low turnout and token concentration are fundamental flaws in the Web3 governance model. Unsurprisingly, as early as early 2026, Ethereum co-founder Vitalik Buterin called for developing more advanced forms of DAOs, calling the dominant model "unproductive and weak," vulnerable to capture and unable to mitigate the shortcomings of human politics.

Audit Is Not a Security Guarantee

While holes are being sought in DAO governance without a single line of exploit code, the situation with code is different. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities — long-known methods were used:

• reentrancy errors;
• access control errors;
• oracle manipulation;
• logical errors in protocol business logic.

Cross-chain bridges are especially vulnerable. According to Phemex data as of April 2026, bridges have lost over $2.8 billion since 2022 — about 40% of all stolen funds in Web3. The complexity of cross-chain messaging creates a broad attack surface that is difficult to assess in its entirety.

2026 provided several telling examples: the Truebit hack of $26.4 million due to integer overflow, the attack on the IoTeX bridge with control over a validator's private key, and the year's largest exploit — an attack on the liquid restaking protocol Kelp, where about 116,500 rsETH worth $292 million were drained from a LayerZero bridge. All of this happened despite having badges from CertiK and Code4rena.

Prompt Instead of Auditor

While specialists studied recurring patterns, an adversary emerged for whom such analysis is a routine task. On December 1, 2025, Anthropic announced the use of AI models to find vulnerabilities in smart contracts. During a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, extracting $550.1 million. When tested on 34 contracts hacked after March 2025, the results were also impressive.

In practice, this is already happening. Chainalysis specialists have recorded multiple nearly identical simultaneous attempts to hack different contracts, indicating automated vulnerability scanning. The barrier to entry into hacking is lowering faster than the quality of defenses is improving. For a significant portion of typical attacks, formulating the right prompt is now sufficient.

The Key Matters More Than the Contract

No audit could have prevented the largest thefts of the past two years. According to Chainalysis data for 2024, private key theft accounted for about 40% of stolen funds. Attacks are increasingly aimed not at the blockchain but at the infrastructure around it.

The Bybit hack on February 21, 2025, is telling, when the exchange lost $1.46 billion in ETH. Attackers interfered with the fund transfer process: in the Safe interface, signers saw substituted data and approved an outwardly correct transaction that transferred control of the wallet. In June 2026, Humanity Protocol suffered a similar fate, losing $31 million due to key access through a backup copy on a developer's infected computer.

What Actually Works?

When the decision-making process is hacked rather than the code, audits alone are insufficient. The industry is changing its approach to storing and confirming operations:

• MPC wallets that eliminate a single point of failure;
• account abstraction with social recovery;
• passkey authentication to protect against phishing;
• hardware and cold wallets instead of software solutions.

Protection is shifting from one-time checks to dynamic real-time monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The proactive response model has already proven effective: on September 2, 2025, Chainalysis's Hexagate system detected preparations for an attack on the Venus protocol 18 hours in advance and automatically paused it 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, handing control over to mathematics. Hack statistics demonstrate the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. It seems the main systemic vulnerability of the blockchain economy lies not in algorithms but in the fact that there are still people at both ends of the wire.

My conclusion: the industry is transitioning from the paradigm of "absolute code security" to a "risk management" model, where the human factor and response speed become critically important. Investments in monitoring and automated protection are now no less important than smart contract audits.