BONK DAO Attack Drains $20 Million After $4.4 Million Governance Buy
CoinDesk reported that an attacker spent roughly $4.4 million to buy just over 1 percent of BONK supply, passed BIP #76 with seven wallets voting, and drained about $20 million from BONK DAO.
BONK DAO Proposal Cleared A 1% Quorum
CoinDesk reported that a BONK DAO governance attack turned a temporary token position into control of a memecoin treasury.
The attacker spent roughly $4.4 million to buy just over 1 percent of BONK's supply and pushed through a proposal that drained about $20 million in BONK tokens.
The Solana-based DAO's onchain system executed the transfer automatically after the vote passed.
The incident centres on a governance vote rather than a conventional private-key breach.
BONK is a Solana-based memecoin, while BONK DAO is the decentralised autonomous organisation that governs it.
Token holders vote on proposals that can execute onchain if they pass.
June 30 Proposal Sent Treasury Tokens To The Attacker
Chainalysis traced the first step to June 30, when an anonymous wallet proposed moving the treasury holdings into a wallet under its control.
The ballot needed yes votes equal to 1 percent of BONK's supply to meet quorum.
A separate wallet acquired that voting power over July 4 and 5 by spending about $4.4 million to buy BONK on Bybit and Binance.
Lookonchain also traced borrowing through DeFi lending platforms.
Seven Wallets Voted While 18,000 Members Did Not
The proposal, titled "BIP #76 - Sowellian BonkDAO," passed with just seven wallets voting while more than 18,000 members did not vote.
Turnout was 2.9 percent, and 99.9 percent of the votes cast supported the measure.
The vote cleared quorum by a narrow margin, with 882.38 billion BONK in favour against an 879.95 billion threshold.
The written proposal included a transfer instruction for 4.43 trillion BONK to the attacker's wallet.
Chainalysis Traced Transfers After The Drain
By July 6, the voter held enough tokens to pass the measure.
About $20 million in BONK then moved automatically from the treasury into the attacker's wallet.
Chainalysis traced roughly $188,000 to an exchange about nine hours later, while the remaining $19 million moved to a multisig wallet.
The attacker later sold about $5.3 million of the BONK acquired for the vote while retaining the treasury tokens.
BONK DAO Seeks Recovery
BONK DAO confirmed what it called a malicious governance proposal and identified exchange wallets used to buy tokens before the vote.
Its response involved exchanges, bridges and the Solana Foundation.
No final law-enforcement outcome, frozen exchange balance, recovery timetable, treasury reimbursement term or governance-rule change has been disclosed.
