Key Takeaways
An attacker spent about $4.4 million buying BONK tokens over the July 4 weekend, then used them to pass a governance proposal that drained roughly $20 million from the DAO's treasury.
The vote drew just seven wallets against more than 18,000 members who did not vote, clearing the 1 percent quorum threshold by the narrowest of margins.
Every step was a valid onchain transaction, reviving the debate over whether buying a vote is theft or fair use of flawed governance rules.
An attacker drained about $20 million from BONK DAO's treasury late Monday by doing something no hack requires. They followed the rules.
The sequence began on June 30, when an anonymous wallet submitted a proposal to transfer the treasury's holdings to a wallet it controlled, according to Chainalysis. Over July 4 and 5, a separate wallet spent about $4.4 million buying BONK on Bybit and Binance, with more borrowed through DeFi lending platforms, per Lookonchain. The proposal, titled BIP #76, promised to "rebuild from the ashes, monetize holdings, stop the bleeding," while its only operative instruction moved 4.43 trillion BONK to the attacker's wallet.
The numbers are worth sitting with. Seven wallets voted. More than 18,000 members did not. Turnout was 2.9 percent, and the yes votes cleared the DAO's 1 percent quorum by almost exactly the stake the attacker had spent days assembling, CoinDesk reported. The 99.9 percent yes result was effectively a single voter agreeing with itself.
Nine hours after the drain, about $188,000 moved to an exchange while the remaining $19 million sat in a multisig wallet, Chainalysis said. The attacker began selling its bought stake about an hour after the treasury moved, offloading roughly $5.3 million. BONK fell about 7 percent, and the DAO said it is working with exchanges, bridges, the Solana Foundation, and law enforcement.
There was no timelock, no multisig check, and no review step to catch a proposal that emptied the treasury. A DAO treasury is only as secure as the cost of buying a voting majority, and here that cost was about a fifth of the prize. That math is why governance design keeps showing up in our reporting, from Wyoming's DUNA framework giving DAOs legal accountability to the DOJ's seizure of Huione Group's laundering infrastructure.
People Also Ask
What happened in the BONK DAO governance attack?
An attacker bought about $4.4 million in BONK tokens, used them to pass a proposal titled BIP #76 that transferred roughly $20 million in treasury funds to a wallet they controlled, then began selling the tokens they had bought for the attack.
How many people voted on the malicious BONK proposal?
Seven wallets voted while more than 18,000 DAO members did not, a turnout of 2.9 percent. The attacker's stake alone cleared the 1 percent quorum, and the proposal passed with 99.9 percent voting yes.
Is a DAO governance attack theft or fair use of the rules?
Every step used valid onchain transactions, and some observers argue the attacker exploited weak governance design rather than breaking in. BONK DAO, the analytics firms tracing the funds, and law enforcement treat it as an attack.
How can DAOs prevent governance attacks?
Common protections include timelocks that delay execution, higher quorum requirements, multisig checks on treasury transfers, and review steps that flag proposals moving funds to unknown wallets. BONK DAO had none of these in place when the proposal executed.