In a sobering demonstration of token-weighted voting risks, BonkDAO suffered a $20 million treasury loss on July 6, 2026. The attacker did not exploit any smart contract vulnerability or steal a private key. Instead, they simply bought enough BONK tokens—roughly $4.4 million worth—to pass a malicious proposal that transferred the vast majority of the DAO’s treasury to a wallet under their control.
The proposal, known as BIP #76, was submitted on June 30 and styled as a “governance renewal plan.” It included a note promising tokens to yes-voters, but its core instruction was to move 4.43 trillion BONK out of the treasury. Over the following six days, the attacker accumulated voting power by purchasing BONK through exchange wallets, a pattern later traced by on-chain researchers at SlowMist. On the day of the vote, the attacker cast an assembled stake of 882.38 billion BONK, just edging past the quorum threshold of 879.95 billion. Turnout was a mere 2.9%, and the “yes” vote was 99.9%.
The system worked exactly as designed. BonkDAO’s governance runs on Realms, Solana’s standard DAO tooling, which automatically executes passed proposals. There was no timelock, no multi-sig veto, and no human review to stop the transfer. The underlying failure is economic: the cost of acquiring decisive voting power was far smaller than the value of the treasury it controlled. A metric often called “cost of corruption” was disastrously lopsided—around $4 million to buy a majority, against a $20 million prize.
The incident echoes the 2022 Beanstalk exploit, but without the need for flash loans. It underscores a broader, uncomfortable truth: DAO treasuries governed by token-weighted voting are only as secure as the market price of their quorum. The aftermath saw BONK’s price dip roughly 8–10%, and major exchange Upbit suspended BONK deposits and withdrawals. While recovery efforts focus on choke points like exchange interfaces and potential identity trails, the realistic outcome may be attrition rather than restoration of funds.
The event is already sparking industry-wide conversations about default governance safeguards—timelocks, veto councils, and dynamic quorum requirements—and serves as a stark warning to every DAO: if your treasury’s value exceeds the cost of buying your quorum, your assets are not truly owned, merely rented.
