BONK faces $20 million treasury drain after attacker spends $4 million to pass malicious proposal

Onchain governance was heralded a few years ago as the future of how communities run themselves. But a multimillion-dollar attack on the memecoin BONK shows the cost of putting a treasury at the mercy of a public vote anyone can buy their way into.

BONK DAO was drained of $20 million late Monday, the culmination of a week-long scheme in which an opportunistic attacker spent about $4.4 million buying up the project's bonk tokens to force through a vote. Every step was a legitimate transaction — such as the buying, the vote, the payout — and together they carried out a theft.

BONK is a Solana-based memecoin, and BONK DAO is the decentralized autonomous organization that governs it, a structure where token holders vote on proposals rather than a company making decisions. Anyone holding enough tokens can propose a change and, if a vote passes, have it executed automatically onchain.

That design was the specific weapon used in this attack. BONK prices are down 7% in the past 24 hours, data shows, in the aftermath of the attack.

The sequence began on June 30, when an anonymous wallet submitted a proposal to transfer the treasury's holdings to a wallet it controlled, per Chainalysis. To pass, the proposal needed yes votes equal to 1% of BONK's supply, the quorum, or minimum participation, required for it to take effect.

Over July 4 and 5, a separate wallet acquired exactly that much, spending about $4.4 million to buy BONK on the exchanges Bybit and Binance and, by one account, borrowing more through DeFi lending platforms, according to Lookonchain.

Titled "BIP #76 - Sowellian BonkDAO," the proposal passed with just seven wallets voting, against more than 18,000 members who did not, a turnout of 2.9%.

It cleared quorum by the narrowest margin, 882.38 billion BONK in favor against an 879.95 billion threshold, almost exactly the stake the attacker had spent days assembling.

The 99.9% "yes" result was effectively a single voter agreeing with itself. Its written pitch reads less like a governance motion and more like a boast, promising to "rebuild from the ashes, monetize holdings, stop the bleeding," with a line noting that "all YES voters are eligible to receive tokens."

Beneath it sat the only instruction that should have turned heads – a transfer of 4.43 trillion BONK to the attacker's wallet.

By July 6, the voter held just enough. It cast its entire stake in favor of the proposal, which then passed, and shortly after, about $20 million in BONK automatically moved out of the treasury into the attacker's wallet.

Nine hours later, roughly $188,000 was sent to an exchange, likely to cash out, while the remaining $19 million was sent to a multisig wallet, which requires multiple approvals to move funds, Chainalysis said.