Crypto news

July 2026 was marked by a paradoxical incident: the code of BonkDAO — the governing structure of the Solana memecoin — worked flawlessly, but the treasury lost about $20 million. There was no hack in the conventional sense: the vote was legitimate, and the attacker acted strictly within the rules. This is not an anomaly but an alarming trend that is redefining the landscape of cyber threats in Web3.

Attack on decentralization as the new standard

On July 6, 2026, BonkDAO faced a governance takeover that resulted in the theft of approximately 4.43 trillion BONK tokens. The scheme turned out to be painfully simple: disguised as a routine proposal, Bonk Improvement Proposal #76 on participant rewards, the hacker embedded a malicious fund transfer function. By spending $4.4 million on centralized exchanges to purchase 1% of the supply, he secured control over nearly 100% of the votes amid extremely low turnout. Six days later, the proposal executed automatically.

The system's key flaws — the absence of a time delay for executing decisions, a low quorum threshold, and the team's lack of veto power — made the attack inevitable. This is not an isolated case: a year earlier, a similar attempt was made against the Compound protocol's DAO, where attackers tried to withdraw 499,000 COMP tokens worth $24.1 million. That attack was repelled through negotiations, but only after the proposal had been passed.

Low turnout and token concentration are not a bug in the code but a fundamental flaw in governance tokenomics. Ethereum co-founder Vitalik Buterin, already in early 2026, criticized the dominant token-based governance model, calling it "weak" and "vulnerable to capture." It seems his concerns are being confirmed in practice.

Audit is not a panacea

While some look for holes in governance, others face technical issues. According to analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers are not reinventing the wheel: they exploit classic errors — reentrancy, access control issues, oracle manipulation, and logic bugs in business logic.

Cross-chain bridges are especially vulnerable: since 2022, they have lost over $2.8 billion, accounting for about 40% of all stolen funds in Web3. The complexity of cross-network messaging creates a huge attack surface that is difficult to assess in its entirety. Notable examples from 2026: the Truebit hack for $26.4 million due to integer overflow, an attack on the IoTeX bridge validator with damages of $4.4 million, and the record Kelp exploit for $292 million through a single LayerZero validator.

AI as a new threat

The situation is exacerbated by the development of artificial intelligence. In December 2025, Anthropic announced the creation of the SCONE-bench benchmark, which includes 405 real hacked contracts. Neural networks successfully attacked 207 of them, withdrawing $550.1 million in simulation. This is no longer theory: Chainalysis records multiple synchronous hacking attempts on dozens of contracts, indicating automated vulnerability scanning. The barrier to entry into hacking is falling faster than the quality of protection is rising.

The key matters more than the code

However, no audit would have saved against the largest thefts of recent years. Private key theft accounted for about 40% of all stolen funds in 2024. The Bybit hack for $1.46 billion in February 2025 is a vivid example: attackers swapped data in the Safe interface, and signers approved an externally correct transaction. A similar fate befell Humanity Protocol in June 2026, when keys were stolen from a developer's infected computer.

What works?

The industry is forced to adapt. One-off audits are being replaced by dynamic real-time monitoring systems such as Forta Network and Hypernative. The preventive model has already proven effective: in September 2025, Chainalysis's Hexagate system detected preparation for an attack on the Venus protocol 18 hours in advance and automatically paused it 20 minutes before the final transaction.

Web3 architecture was designed to eliminate trust in humans, but statistics show the opposite. Perfect code is powerless if a developer clicks a phishing link and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in algorithms but in people, who remain at both ends of the wire.

My comment: The industry is undergoing a painful transition from naive faith in "code as law" to the realization that security is a comprehensive process involving governance, monitoring, and the human factor. Projects that fail to heed this lesson are doomed to become the next statistic in hacking reports.