Crypto news

While the industry continues to search for the perfect code, reality demonstrates a paradox: the most devastating attacks of recent years require not a single line of exploit. The hack of BonkDAO's governance in July 2026, which drained $20 million from the treasury, is a perfect illustration of this thesis. The vote was completely legitimate from a technical standpoint, and the attacker acted strictly within the organization's charter.

Attack on decentralization

The attack scheme on BonkDAO is frightening in its simplicity. Disguised as a routine proposal to improve the protocol, the hacker embedded a malicious function, and to reach quorum spent $4.4 million on centralized exchanges, buying up just 1% of BONK's issuance. With extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the transaction executed automatically, and $20 million vanished.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO, but the attack was repelled. The problem is systemic: the lack of time-delay mechanisms, a low quorum threshold, and community passivity make token-based governance easy prey. This is why Vitalik Buterin, as early as early 2026, called for a complete rethink of the DAO concept, calling the dominant model "weak and vulnerable to capture."

Code doesn't save

Analysis of 2025 incidents reveals a troubling trend: 90% of hacked smart contracts had successfully passed audits. Attackers are not looking for complex zero-day vulnerabilities—they exploit classic errors: reentrancy, access control issues, oracle manipulation, and logic bugs that scanners fail to detect.

Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022—about 40% of all stolen funds in Web3. The cases of Truebit, IoTeX, and Kelp in 2026 confirm: the complexity of such systems creates an attack surface that cannot be fully assessed.

AI—a new threat

The situation is exacerbated by the arrival of AI. Anthropic's tests on the SCONE-bench benchmark showed: neural networks can successfully attack 207 of 405 real-world hacked contracts, extracting $550 million in simulation. Already now, Chainalysis records multiple synchronous hacking attempts on dozens of contracts—this is automated brute-forcing unavailable to humans.

The key matters more than the code

But even AI is not the main threat. Private key theft is the cause of 40% of all stolen funds, more than any other vector. The $1.46 billion Bybit hack in February 2025 and the attack on Humanity Protocol in June 2026 are vivid examples of how compromising a work device or data substitution in the interface nullifies any technical guarantees.

What works?

The industry is gradually shifting from one-off audits to dynamic real-time monitoring. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol case in September 2025 demonstrated effectiveness: the attack was prevented 20 minutes before the final transaction.

Web3 architecture was created to eliminate trust in humans, but the statistics are relentless: the main vulnerability lies in people. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. Perhaps it's time to admit: the "bug" is not an error in the code, but human nature itself, which cannot be fixed by any update.