Crypto news

July 2026 will be remembered by the crypto community not for Bitcoin's price, but for a paradoxical incident: the code of BonkDAO — the governance structure of the Solana memecoin — worked flawlessly. Yet, about $20 million evaporated from the organization's treasury. There was no hack in the classic sense: the vote was legitimate, but the results were catastrophic.

This case is a vivid illustration of how attacks on governance mechanisms are becoming the new norm. Attackers are increasingly exploiting not code errors, but human passivity and the imperfections of decentralized processes. Notably, even AI analysis of outdated smart contracts has become a double-edged sword: it helps both defenders and attackers.

Governance Takeover: Legal Theft

On July 6, 2026, BonkDAO suffered an attack on its governance system. The attacker stole approximately 4.43 trillion BONK tokens, exploiting fundamental weaknesses in the DAO's architecture. Disguised as a routine proposal, Bonk Improvement Proposal #76, which promised rewards to voters, the hacker embedded a malicious function to withdraw funds.

To reach quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the transaction executed automatically. The critical vulnerabilities were obvious: the lack of a time delay for executing decisions, a quorum threshold that was too low, and the absence of a team veto right.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO. In July 2024, attackers tried to withdraw 499,000 COMP tokens (~$24.1 million) using a malicious proposal. With typical voter turnout of 4–5%, such a package provided full control over the vote. That attack was repelled, but only after the proposal was passed, through negotiations. The problem, as I have repeatedly noted, lies not in the code, but in the token-voting model itself, which encourages apathy and concentration of power.

Audit Is Not a Panacea

While DAOs search for holes without a single line of exploit code, the situation with code is different. According to my data, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers do not use complex zero-day vulnerabilities, but rather long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic.

Cross-chain bridges are especially vulnerable. Since 2022, they have lost over $2.8 billion, accounting for about 40% of all stolen funds in Web3. The complexity of cross-network messaging creates a huge attack surface. Examples from 2026 are telling: the Truebit hack of $26.4 million due to integer overflow, the attack on the IoTeX bridge involving the compromise of a validator's private key, and the year's largest exploit — the withdrawal of $292 million from the Kelp protocol.

AI as a Hacking Tool

A new wave of threats is linked to artificial intelligence. In December 2025, Anthropic announced that their AI models successfully attacked 207 out of 405 real hacked smart contracts, extracting a virtual $550.1 million. This confirms my concerns: the barrier to entry in hacking is rapidly falling. What previously required an experienced Solidity developer now boils down to crafting the right prompt.

The Key — The Primary Target

However, no audit would have saved against the largest thefts of recent years. According to Chainalysis, private key theft is the cause of about 40% of all stolen funds. The Bybit hack of $1.46 billion in February 2025 is the most striking example. Attackers swapped data in the Safe interface, and signers approved a transaction that transferred control of the wallet. Similarly, in June 2026, Humanity Protocol lost $31 million due to malware on a developer's computer.

Protection is shifting from one-time checks to dynamic monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The model is already working: in September 2025, an attack on Venus Protocol was prevented 20 minutes before the final transaction.

Web3 architecture was created to eliminate trust in humans, but statistics say otherwise. Perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. The main systemic vulnerability of the blockchain economy is not in algorithms, but in the people at both ends of the wire. That is why I predict that the next major hacks will be linked not to cryptography, but to social engineering.