The decentralized governance structure of BONK, a Solana-based meme coin project, became the target of a notable attack in the crypto market. Around $20 million worth of BONK tokens were removed from the BONK DAO treasury. The most striking part of the incident was that the funds were not moved through a classic hack, but through the project’s own onchain governance system.
The incident reopened the debate around the security of decentralized autonomous organizations. The attacker did not force their way into the system or break the code by exploiting a smart contract vulnerability. Instead, they bought enough voting power, submitted a proposal, passed the vote and enabled the treasury transfer to be executed automatically.
This exposed a long-discussed weakness in onchain governance models. If a DAO treasury can be controlled by an actor who temporarily secures a majority, its security depends not only on technical infrastructure but also on the cost of buying voting power.
The Attack Came After a Week of Preparation
The process dates back to June 30. According to information cited by Chainalysis, an anonymous wallet submitted a proposal to transfer the BONK DAO treasury’s tokens to an address under its own control. For the proposal to take effect, it had to meet a minimum participation threshold equal to 1% of BONK’s supply.
This threshold became the central point of the attack. It was not enough for the attacker to submit the proposal; they also needed enough BONK tokens to pass the vote. For this reason, the attacker began accumulating a large amount of BONK from the market through a different wallet on July 4 and 5.
According to Lookonchain data, the attacker spent around $4.4 million on Bybit and Binance to purchase enough BONK. Some estimates suggest that additional funds were also obtained through DeFi lending platforms. As a result, the attacker built voting power almost exactly at the level needed to pass the proposal.
Seven Wallets Voted, More Than 18,000 Members Did Not Participate
The proposal, titled “BIP #76 - Sowellian BonkDAO,” passed with very low participation. Only seven wallets voted in the process. By contrast, more than 18,000 BONK DAO members did not take part in the vote.
The turnout remained at 2.9%. Despite this, the proposal cleared the minimum participation threshold, known as quorum, by a very narrow margin. The number of votes in favor reached 882.38 billion BONK. The required threshold stood at 879.95 billion BONK.
This margin almost exactly matched the voting power the attacker had accumulated over several days. The final result showed 99.9% “yes” votes. However, this high approval rate reflected a single powerful actor approving its own proposal rather than a broad community consensus.
The proposal text also drew attention. It included phrases about restructuring the treasury, using assets to generate revenue and stopping losses. It also stated that “yes” voters would be eligible to receive tokens. However, the real outcome of the proposal was the transfer of 4.43 trillion BONK to the attacker’s wallet.
The $20 Million Transfer Was Executed Automatically
On July 6, the attacker used their entire voting power in favor of the proposal. After the proposal passed, around $20 million worth of BONK tokens were automatically transferred from the DAO treasury to the attacker’s wallet.
At this point, no manual approval process came into play. Due to the design of the onchain governance system, the proposal was executed directly because it met the required conditions. This also showed why the attack was so technically controversial.
According to Chainalysis, around $188,000 worth of assets were sent to an exchange roughly nine hours after the transfer. This transaction was likely intended for cashing out. The remaining assets, worth around $19 million, were moved to a multisig wallet.
The attacker also began selling the BONK tokens they had accumulated to carry out the attack. Around one hour after the treasury was drained, they sold approximately $5.3 million worth of BONK. In this way, the attacker offloaded the tokens used to gain voting power while keeping the treasury tokens in a separate wallet.
South Korean Exchanges Launch BONK Review
Following the attack, risk perception also rose quickly in the South Korean market. The country’s three major crypto exchanges, Upbit, Bithumb and Coinone, placed BONK on their review lists. This decision means the exchanges may reassess their trading support for the token following the security incident.
BONK Price Came Under Pressure
BONK also saw a price decline after the attack. According to available data, the token lost around 7% over the past 24 hours. This drop reflected both the confidence shock caused by the treasury loss and the attacker’s market sales.
BONK DAO later confirmed the incident. The project team described it as a malicious governance proposal that drained the treasury. In its statement, the DAO said it had identified the exchange wallets used to purchase tokens before the vote.
BONK DAO also said it was working with exchanges, bridge protocols and the Solana Foundation to manage the situation. It remains unclear how the legal and technical follow-up process will unfold.
