Why Crypto’s Biggest Losses Are No Longer Just Smart Contract Failures

• BonkDAO lost $20M in a governance attack.
• Crypto hackers are increasingly targeting operational security.
• Experts say audits alone are no longer enough.

When BonkDAO lost around $20 million from its treasury last month, the immediate assumption was that hackers had exploited a flaw in the protocol’s code. That wasn’t the case. Instead, the attacker accumulated enough governance tokens to push through a proposal during a low-participation vote. The system performed exactly as designed—the weakness was in the governance process itself.

A similar pattern emerged in June when Humanity Protocol suffered losses exceeding $30 million. According to the project, the attack stemmed from a compromised private key belonging to a team member, not from a vulnerability in the smart contract. Once again, operational security—not faulty code—proved to be the critical point of failure.

Crypto Hacks Are Evolving

These incidents reflect a broader shift in the crypto security landscape. While the industry has reportedly lost about $972 million to hacks so far in 2026, many of the largest attacks are no longer driven by coding errors alone. Instead, attackers are increasingly exploiting stolen signing keys, weak governance systems, compromised infrastructure, and human mistakes.

Historical data reinforces this trend. An analysis of 425 major crypto hacks between 2021 and 2025 found that operational failures accounted for a disproportionate share of financial losses. Between 2024 and 2025 alone, more than half of the value stolen across 191 incidents was linked to centralized exchange compromises, where attackers targeted custody systems, signing infrastructure, and private keys rather than smart contracts.

Smart Contracts Still Need Continuous Protection

This does not mean smart contract security has become less important. Critical vulnerabilities continue to appear in blockchain applications, especially as protocols evolve through upgrades and new features. Every software update introduces fresh risks, making continuous security testing essential throughout a project’s lifecycle.

The difference today is that many protocols have strengthened their code through ongoing security programs. Bug bounty initiatives and continuous monitoring encourage security researchers to identify vulnerabilities before malicious actors can exploit them. In many cases, relatively modest bounty payments can prevent attacks that would otherwise result in losses worth tens of millions of dollars.

Why Security Audits Alone Are Not Enough

A security audit evaluates the code at a specific moment in time, but it cannot guarantee that private keys are properly protected, governance mechanisms are resilient, or operational procedures are secure. Several projects that underwent multiple audits have still suffered significant losses because attackers targeted weaknesses outside the codebase.

Security today extends far beyond reviewing smart contracts. Projects must also secure key management, governance structures, employee devices, monitoring systems, and incident response processes to reduce the risk of operational failures.

The Future of Crypto Security

The latest wave of crypto attacks sends a clear message: protecting a protocol is no longer just about writing secure smart contracts. True security depends on securing every layer of the ecosystem—from code and infrastructure to governance and human operations.

As the industry matures, projects that combine strong code with robust operational security and continuous monitoring are likely to be better positioned against the increasingly sophisticated tactics used by attackers.