Crypto news

July 2026 became a landmark month for the entire Solana ecosystem. The code of BonkDAO — the governing body of one of the most famous memecoins — worked perfectly, without a single error. And yet, the treasury lost approximately $20 million. There was no hack in the classic sense: the vote was legitimate, and the transaction was approved by all the rules of the decentralized system.

This incident is not an anomaly but a natural outcome of the evolution of attacks. We are witnessing a fundamental shift: attackers no longer hack code; they hack the decision-making process. And in this new reality, the human factor becomes not just a weak link but the primary attack vector.

Governance Attack: Legalized Robbery

On July 6, 2026, an attacker pulled off an operation that will go into cybersecurity textbooks. Disguised as a routine proposal, Bonk Improvement Proposal #76, about rewarding voting participants, they embedded a malicious function to transfer funds to their own address. To reach a quorum, the hacker spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low voter turnout, this was enough to control nearly 100% of the votes.

The DAO's architecture did not provide a mechanism for a time delay in executing decisions, and the quorum required to dispose of colossal sums turned out to be laughably low. The team did not even have emergency veto rights. The attacker simply carefully read the organization's charter — and found a weak spot in it.

This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol's DAO, trying to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only after the proposal was passed — through negotiations. Significantly, Ethereum co-founder Vitalik Buterin warned back in early 2026 that the token-oriented governance model is ineffective, vulnerable to capture, and "completely fails at mitigating the shortcomings of human politics."

Audit as Fiction

While vulnerabilities are being sought in governance without a single line of exploit code, the situation with code is paradoxical. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require complex zero-day vulnerabilities — methods known to the industry for years were used: reentrancy errors, access control issues, oracle manipulations.

The cases of 2026 are especially telling. The Truebit protocol lost $26.4 million due to an integer overflow in a legacy contract deployed five years ago. The IoTeX bridge was compromised through a validator's private key. And the largest exploit of the year — the attack on the liquid restaking protocol Kelp, where $292 million was drained through a single cross-chain message validator.

Badges from CertiK and Code4rena proved useless. The industry received a harsh lesson: a one-time code review does not protect against dynamic threats.

AI as a New Threat

The situation is compounded by the arrival of artificial intelligence. In December 2025, Anthropic announced the use of AI models to find vulnerabilities. In a simulation on the SCONE-bench benchmark, consisting of 405 real hacked contracts, neural networks successfully attacked 207 of them, draining $550.1 million. Already in June, Chainalysis specialists recorded multiple nearly identical attempts to hack different contracts simultaneously — a clear sign of automated vulnerability scanning.

The barrier to entry for hacking is decreasing faster than the quality of defense is improving. Just a few years ago, finding an exploitable vulnerability required an experienced Solidity specialist. Now, for a significant portion of typical attacks, it is enough to correctly formulate a query to an LLM.

The Key Matters More Than the Contract

But no audit would have prevented the largest thefts of recent years. According to Chainalysis, private key theft was the cause of about 40% of all stolen funds — more than any other attack vector. The $1.46 billion Bybit hack, the largest in crypto industry history, occurred due to data substitution in the Safe interface: signers approved an externally correct transaction that transferred control of the wallet to the attackers. And Humanity Protocol in June 2026 lost $31 million due to a backup of keys on a developer's infected computer.

What Actually Works?

The industry is forced to rebuild its defenses. One-time checks are being replaced by dynamic real-time monitoring systems. The case of Venus Protocol is telling: Chainalysis's Hexagate system detected anomalous activity 18 hours before the main phase of the attack and automatically paused the protocol 20 minutes before the final transaction. The funds remained safe.

MPC wallets, account abstraction with social recovery, passkey authentication — all these mechanisms are becoming the de facto standard. But the main conclusion I draw from analyzing these incidents is this: Web3 architecture, designed to completely eliminate trust in humans, in practice demonstrates the opposite effect. Perfectly written code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover. Perhaps the most systemic vulnerability of the blockchain economy lies not in algorithms, but in the fact that at both ends of the wire, there are still people. And until we acknowledge this fact, any technical innovation will be merely a temporary patch.