Morning Edition · Tuesday, July 7, 2026

Attacker Drains About $20 Million From BonkDAO by Buying a Governance Majority

A capital-rich actor spent roughly $4.4 million to acquire the votes needed to pass a proposal that emptied the treasury.

Save

Attacker Drains About $20 Million From BonkDAO by Buying a Governance Majority

An attacker used BonkDAO's own on-chain governance system to steal about $20 million from the treasury of BONK, a memecoin built on the Solana blockchain, by exploiting its token-weighted voting. According to CoinDesk, the method was governance capture rather than a flaw in the smart-contract code. An anonymous wallet submitted a proposal on June 30 to send the treasury to an address it controlled. Then, over July 4 and 5, a separate wallet spent roughly $4.4 million buying just over 1% of BONK's supply on the exchanges Bybit and Binance.

That purchase was enough to reach quorum, the minimum participation required for a vote to count, in a ballot with low turnout. On July 6 the wallet voted its full stake in favor, the measure passed with almost unanimous support, and about $20 million in tokens moved automatically out of the treasury. Roughly $188,000 was later sent to an exchange, likely to be cashed out, while about $19 million remains in a multi-signature wallet that requires several approvals to move.

BonkDAO said it is coordinating with exchanges, the Solana Foundation, and law enforcement to recover the funds. The root cause is structural. When a treasury is governed by token-weighted votes and turnout is low, anyone willing to spend less than the value of the treasury can buy a decisive majority, a weakness that no audit of the contract code would detect.

Veracity: Corroborated

91/100

If true, who benefits: The anonymous wallet that captured the vote gains directly, and advocates of timelocks and quorum reform gain a case study that raises demand for their designs.
The nuance: The on-chain sequence is verifiable, but the attacker's identity and motive are unknown, and whether this counts as theft or the lawful use of token-weighted voting rules is itself the contested point.

An open-source-intelligence read of how likely this story is true with its real nuance, not a judgment of any outlet. It assesses the claim, weighing independent and adversarial reporting. How we label confidence.

What this means

The incident clearly demonstrates that decentralized governance can be a financial attack surface, not just a coordination tool. Any protocol whose treasury is worth more than the market cost of a voting majority faces the same math, which pushes serious projects toward timelocks (enforced delays before an approved action can execute), execution delays, and quorum rules that raise the cost of capture.

What to watch

Whether any of the roughly $19 million in the multi-signature wallet is frozen or returned, which will test how much influence exchanges and foundations retain after funds leave a treasury.
Whether other token-governed treasuries add execution delays or veto mechanisms in response, the practical fix that would make imitation attacks harder.

Observations to monitor, not financial advice.

2 sources

Synthesized from: CoinDesk · crypto.news

Part of a tracked trend

Token-Weighted Governance Invites Capture

As on-chain treasuries grow under token-weighted voting with low participation, capital-rich attackers will repeatedly find it cheaper to buy a governance majority than to breach code, making governance design a recurring and market-relevant attack surface.