Image credit: Pexels
BonkDAO said an attacker drained about $20 million worth of BONK from its treasury through a malicious governance proposal on Solana.
The project said law enforcement has been notified and that it is working with exchanges, bridges and the Solana Foundation to trace funds and identify the person or group behind the attack.
Attacker Bought $4.4M BONK for Voting Power
The attack did not appear to rely on a typical smart contract exploit. Reports said an anonymous wallet submitted a governance proposal on June 30 that would transfer treasury assets to a wallet it controlled.
The proposal was titled “BIP #76 – Sowellian BonkDAO.” To pass, the vote needed support equal to 1% of BONK’s supply.
The attacker then spent about $4.4 million buying enough BONK to meet that threshold. The tokens were reportedly accumulated through exchanges including Binance and Bybit, with some additional voting power linked to DeFi borrowing.
Seven Wallets Approved $20M Treasury Transfer
The proposal passed with only seven wallets voting. The final tally showed almost all votes in favor, but the result was driven by the attacker’s own voting power.
More than 18,000 members did not vote, leaving the proposal able to clear quorum by a narrow margin.
Once the vote passed, the governance system executed the transfer automatically. About 4.43 trillion BONK, worth roughly $20 million at the time, moved out of the DAO treasury.
Low Turnout Exposed DAO Treasury Controls
The incident highlights a treasury risk in token-weighted governance when turnout is low and execution is automatic. A single buyer can become dangerous if they can gather enough voting power to pass a proposal before other members respond.
That risk grows when large treasury transfers do not face extra review, execution delays or multisignature approval. For BonkDAO, the vote turned governance itself into the attack path.
Stolen BONK Starts Moving to Exchanges
BonkDAO said it has identified exchange wallets used to buy BONK before the proposal. The project also said stolen tokens had started moving toward exchanges, raising the risk that some funds could be sold before recovery efforts progress.
South Korean exchange Upbit temporarily suspended BONK deposits and withdrawals after the incident.
The move was meant to protect users while the exchange reviewed the token’s transfer activity. BONK’s price fell after the disclosure as traders reacted to the treasury drain and possible selling pressure from stolen tokens.
Automatic DAO Execution Faces Scrutiny
The BonkDAO attack is likely to bring DAO treasury controls back under review, especially for projects that rely on automatic execution after a vote.
Safeguards such as timelocks, multisignature approvals, execution delays and higher quorum thresholds can slow harmful proposals before funds move.
For BonkDAO, the immediate focus is asset tracing and exchange cooperation. For other DAOs, the incident is likely to renew attention on quorum rules, timelocks and treasury execution controls.
