BonkDAO Loses Around $20 Million to a Malicious Governance Proposal
BonkDAO's treasury was drained via a governance attack: a malicious proposal (BIP #76) passed through the regular voting process and extracted around $20 million in BONK. No smart-contract bug — the attacker bought voting power.
What happened
BonkDAO has confirmed that its treasury was drained of BONK tokens worth around $20 million on 6 July 2026 — via a malicious governance proposal that took the DAO’s regular voting path. The proposal (Bonk Improvement Proposal #76, “Sowellian BonkDAO”) vaguely promised a governance restructuring and passed on the DAO’s own voting platform.
How the attack worked
The remarkable part: there was no smart-contract bug. The attacker used the governance system exactly as built:
- Accumulate voting power: BONK voting weight was quietly built up over several days — per published analyses, tokens worth around $4 million were enough to decide the vote.
- Submit the proposal: it was worded to look like a legitimate restructuring.
- Vote and execute through the regular process: the attacker’s yes-votes passed the proposal; execution transferred the treasury funds. Roughly $4 million of stake extracted roughly $20 million.
The DAO says it is working with exchanges, the Solana Foundation, bridges and law enforcement to trace the funds. Upbit and Kraken paused BONK deposits and withdrawals. The BONK price fell around 9 percent on the news.
Context: governance as an attack surface
The case shows an attack vector that needs no code flaw: when voting power is purchasable and participation is low, an attacker can turn the rules against the organization itself. The classic countermeasures for DAOs with treasuries: quorums and execution timelocks, separate multisig control over the treasury instead of direct proposal execution — as enabled by multisig with Squads — and active delegate participation.
Important distinction: this attack concerns the Bonk project’s own DAO governance — not Solana’s new onchain governance (SGPs), which handles protocol-level direction and is built differently, with support thresholds and delegator override.
This article describes the method based on publicly reported patterns; attribution of addresses and responsible parties is subject to the ongoing tracing by the DAO, exchanges and authorities.
Note: This is reporting, not investment advice.
What to watch
- Whether frozen funds at exchanges can be identified and returned
- Which governance changes (quorums, timelocks, vetoes) BonkDAO implements
- Whether other Solana DAOs tighten their proposal execution