Crypto news

July 2026 became a landmark month for the industry: the code of BonkDAO, the governing body of the Solana memecoin, worked flawlessly, but that did not stop attackers from draining approximately $20 million from the treasury. There was no hack in the classic sense—the vote proceeded legitimately, yet the outcome proved catastrophic. This is not just an incident but a symptom of a deep-seated illness affecting the entire decentralized finance ecosystem.

Governance Attack: When Code Doesn't Save You

On July 6, 2026, BonkDAO faced a governance takeover. The hacker, disguising the attack as a routine Bonk Improvement Proposal #76 about participant rewards, embedded a malicious function to transfer funds to their own address. To reach quorum, they spent about $4.4 million buying up 1% of the BONK supply on centralized exchanges. With low voter turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal executed automatically.

The key problem is the lack of a time-delay mechanism for executing decisions and a quorum threshold that is too low. This is not the first case: a year earlier, a similar attempt was made against Compound, but it was successfully repelled. Low turnout and token concentration are not a code bug but a fundamental flaw in Web3 governance tokenomics. Vitalik Buterin warned as early as 2026 that the dominant DAO model "completely fails at mitigating the shortcomings of human politics."

Audits Are Not a Panacea

While DAOs suffer from governance gaps, the situation with code is no better. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Attackers use long-known methods: reentrancy errors, access control issues, oracle manipulation, and logical errors in business logic. Cross-chain bridges are especially vulnerable, having lost over $2.8 billion since 2022—about 40% of all stolen funds in Web3.

2026 provided telling examples: from an integer overflow in Truebit ($26.4 million) to the IoTeX hack via a validator's private key ($4.4 million) and the year's largest exploit at Kelp for $292 million. Badges from CertiK and Code4rena failed to protect assets.

AI as a New Threat

The situation is compounded by the arrival of AI. In December 2025, Anthropic announced that its models successfully attacked 207 of 405 real-world hacked contracts, extracting a virtual $550.1 million. The barrier to entry in hacking is rapidly falling: now, attacking typical vulnerabilities only requires properly phrasing a request to a neural network, not being an experienced Solidity developer.

The Key Matters More Than the Contract

However, the main attack vector is not code but people. According to Chainalysis, private key theft accounted for about 40% of all stolen funds. The $1.46 billion Bybit hack in February 2025 and the attack on Humanity Protocol ($31 million) in June 2026 are vivid examples of compromised work software and human carelessness.

What Actually Works?

The industry is shifting its focus from one-off audits to dynamic monitoring. MPC wallets, account abstraction with social recovery, passkey authentication, and hardware storage are being implemented. Systems like Forta Network and Hypernative track anomalies in the mempool before a transaction is included in a block. The Venus Protocol case in September 2025 demonstrated effectiveness: the attack was prevented 20 minutes before the final transaction.

My comment: The industry has finally realized that perfectly written code is powerless against social engineering and community apathy. We are moving toward a model where security is not a static audit but a continuous process of monitoring and adaptation. The only question is whether we can restructure in time before AI attacks become fully automated and widespread.