Attacker Drains About $20 Million From BonkDAO by Buying a Governance Majority

An attacker used BonkDAO's own on-chain governance system to steal about $20 million from the treasury of BONK, a memecoin built on the Solana blockchain, by exploiting its token-weighted voting. According to CoinDesk, the method was governance capture rather than a flaw in the smart-contract code. An anonymous wallet submitted a proposal on June 30 to send the treasury to an address it controlled. Then, over July 4 and 5, a separate wallet spent roughly $4.4 million buying just over 1% of BONK's supply on the exchanges Bybit and Binance.

That purchase was enough to reach quorum, the minimum participation required for a vote to count, in a ballot with low turnout. On July 6 the wallet voted its full stake in favor, the measure passed with almost unanimous support, and about $20 million in tokens moved automatically out of the treasury. Roughly $188,000 was later sent to an exchange, likely to be cashed out, while about $19 million remains in a multi-signature wallet that requires several approvals to move.

BonkDAO said it is coordinating with exchanges, the Solana Foundation, and law enforcement to recover the funds. The root cause is structural. When a treasury is governed by token-weighted votes and turnout is low, anyone willing to spend less than the value of the treasury can buy a decisive majority, a weakness that no audit of the contract code would detect.