The $BONK Treasury Theft: DAO Governance Exploit

This is not related to STEEM, but worth sharing story

Governance and DAO exploitation is a serious risk. The recent $BONK treasury drain perfectly demonstrates how token-weighted on-chain voting systems can be gamed when participation is low and safeguards are weak.

BONK is a popular Solana-based dog-themed meme coin. BonkDAO governs its ecosystem treasury through Realms, Solana’s on-chain governance platform. Voting power is directly proportional to the number of $BONK tokens held, and approved proposals execute automatically on-chain.

How the Attack Unfolded (Detailed Timeline)

1. Proposal Submission (June 30, 2026)

The attacker submitted Bonk Improvement Proposal #76 titled “BIP #76 - Sowellian BonkDAO”.
The proposal requested the transfer of 4.426 trillion $BONK (valued at ~$21.2 million) from the BonkDAO treasury wallet to an attacker-controlled wallet (9bxW...JHvQ).

The proposal text used a suspicious pitch about “rebuilding from the ashes,” monetizing holdings, and even suggested YES voters could receive tokens.

2. Building Voting Power (July 4–5, 2026)

Over two days, the attacker purchased 882.285 billion $BONK tokens for approximately $4.4 million on exchanges like Bybit and Binance (possibly supplemented by DeFi borrowing).

This stake was calibrated to just exceed the required quorum of ~879.95 billion $BONK in YES votes (equivalent to 1% of total $BONK supply).

3. The Vote and Automatic Execution (July 6, 2026)

• The attacker voted YES with their entire stake.
• Turnout was abysmal: only 7 wallets voted out of 18,000+ holders (~2.9% participation).
• The proposal passed with 99.9% YES votes, meeting the quorum.
• The treasury automatically transferred 4.426 trillion $BONK (~$20–21.2M) to the attacker’s wallet.

4. Post-Drain Movements

• ~40 billion $BONK (~$188K) deposited to OKX.
• Remaining ~4.386 trillion $BONK (~$19.3M) moved to another wallet (EXaJnm...eh42).
• The attacker began selling portions of the voting tokens acquired (~$5.3M worth initially).

Net Profit: Roughly $16.8 million (spent $4.4M to extract $21.2M).

Immediate Impact

• $BONK price dropped 7–15%, erasing tens of millions in market cap.
• The DAO publicly confirmed the incident as a “malicious governance proposal.”

BonkDAO’s Response

• Identified exchange wallets used to accumulate tokens.
• Coordinating with exchanges, bridges, the Solana Foundation, and law enforcement to track, freeze, and recover funds.
• Some exchanges (e.g., Upbit) temporarily suspended BONK activity.

Why It Succeeded: Critical Governance Failures

• Extremely low quorum (1% of supply).
• Minimal voter participation.
• No time-locks, multisig overrides, or heightened thresholds for treasury drains.
• Automatic on-chain execution with no human intervention layer.

Every step was technically “legitimate” per the DAO rules, highlighting that poor incentive design turns governance into an economic attack vector.

Note

GrokAI used to polish the content and research and used for the cover image generation.