Crypto news

July 2026. The BonkDAO code — the governing structure of the Solana memecoin — worked flawlessly, without a single failure. Nevertheless, about $20 million disappeared from the organization's treasury. There was no hack in the classic sense: the vote was legitimate, and from a code perspective, the transaction was impeccable. This is a striking example of how attacks on governance mechanisms are becoming commonplace, and the weak link is the human, not the algorithm.

Attack on Decentralization

On July 6, 2026, BonkDAO suffered a governance takeover, resulting in the theft of approximately 4.43 trillion BONK tokens. The attacker did not use complex exploits. He carefully studied the organization's charter, found fundamental flaws in it, and took advantage of the community's passivity.

The scheme was simple: disguised as a routine Bonk Improvement Proposal #76 regarding voter rewards, the hacker embedded a malicious function to transfer funds to his own address. To reach a quorum, he spent about $4.4 million on centralized exchanges, buying up 1% of the total BONK supply. With extremely low turnout, this was enough to control nearly 100% of the votes. Six days later, the proposal was automatically executed.

This incident exposed critical flaws in the DAO's architecture: the lack of a time-delay mechanism, a quorum threshold too low for disposing of large sums, and the absence of an emergency veto right for the team. This is not an isolated case. A year earlier, a similar attempt was made against the Compound protocol DAO, when attackers tried to withdraw 499,000 COMP tokens (~$24.1 million). That attack was repelled, but only after the proposal was accepted, through negotiations.

The problem is not a code error, but the very mechanisms of decentralization in Web3. Low turnout and token concentration are a systemic vulnerability. As early as early 2026, Ethereum co-founder Vitalik Buterin criticized the dominant token-based governance model, calling it weak, vulnerable to capture, and unable to mitigate the shortcomings of human politics.

Audit Is Not a Guarantee of Security

While holes are being sought in DAO governance, code has problems of a different kind. According to Kerberus analysts, 90% of smart contracts hacked in 2025 had successfully passed audits. Most attacks did not require finding complex zero-day vulnerabilities. Attackers used long-known methods: reentrancy errors, access control errors, oracle manipulation, and logical errors in business logic.

The issue of cross-chain bridges is particularly acute. Since 2022, they have lost over $2.8 billion, accounting for about 40% of all stolen funds in Web3. The complexity of such systems creates a broad attack surface. Notable examples from 2026:

1. Truebit (January 8): lost $26.4 million due to an integer overflow in an old contract deployed five years ago. A classic logical error that could have been found in a re-audit.
2. IoTeX (February 21): attackers gained control of the bridge validator's private key, updated the contract to a malicious version, and withdrew $4.4 million, minting over 111 million tokens.
3. Kelp (April 18): the largest DeFi exploit of the year — approximately 116,500 rsETH worth $292 million was drained from the LayerZero bridge. The cause was a configuration with a single cross-chain message validator and an attack on RPC infrastructure.

Badges from CertiK and Code4rena did not protect the assets. The industry needs new defense mechanisms.

AI as a New Threat Vector

An adversary is emerging for whom vulnerability analysis is a routine task. In December 2025, Anthropic announced the use of AI models to find flaws in smart contracts. In a simulation on the SCONE-bench benchmark (405 real hacked contracts), neural networks successfully attacked 207 of them, extracting $550.1 million. This means the barrier to entry into hacking is rapidly lowering. Chainalysis is already recording multiple nearly identical hacking attempts on different contracts simultaneously, indicating automated vulnerability scanning.

The Key Matters More Than the Contract

No audit would have prevented the largest thefts of recent years. According to Chainalysis data for 2024, private key theft was the cause of about 40% of stolen funds. The Bybit hack in February 2025 ($1.46 billion in ETH) is a striking example. Attackers swapped data in the Safe interface, and signers approved an outwardly correct transaction, handing over control of the wallet. Similarly, in June 2026, Humanity Protocol suffered, losing $31 million due to key access through a developer's infected computer.

What Actually Works?

When it is not the code being hacked but the decision-making process, audits alone are insufficient. The industry is shifting toward dynamic protection:

• MPC wallets — splitting the key into parts to eliminate a single point of failure.
• Account abstraction with social recovery of access.
• Passkey authentication to protect against phishing.
• Hardware wallets instead of software solutions on work machines.

The key trend is real-time monitoring. Systems like Forta Network and Hypernative track anomalous activity in the mempool before a transaction is included in a block. The Venus Protocol example showed effectiveness: the Hexagate system detected suspicious activity 18 hours before the attack and automatically paused the protocol, preserving funds.

Web3 architecture was created to eliminate trust in humans, handing control over to mathematics. But statistics show the opposite: perfect code is powerless if a developer clicks a phishing link, and the community sleeps during a DAO takeover.

My conclusion: we are witnessing a fundamental shift. The industry is moving from the "security through audit" paradigm to the "security through monitoring and resilience to human factors" paradigm. Those who do not adapt risk becoming the next statistic.