How a $4.4M Buy Drained $20M from BonkDAO Treasury — Attack Explained Step by Step

The BonkDAO attack is a textbook example of how token-weighted governance — when poorly designed — can be weaponised against the very treasury it is meant to protect. The attacker did not find a smart contract vulnerability, exploit a bridge, or break any cryptographic mechanism. They simply bought enough tokens to outvote everyone else, submitted a proposal to take the money, and waited for it to pass.

BONK at a Glance — July 7, 2026

Bonk (BONK) is currently trading at $0.054366, down 8.80% in the last 24 hours. The token’s market capitalization stands at approximately $384.21 million. The sharp decline comes after news broke that BonkDAO suffered a major governance attack, resulting in the loss of roughly $20–21 million worth of BONK tokens from its treasury.

What Happened — The Attack Step by Step

Source: Lookonchain, BonkDAO official statement

The mechanics of this attack are straightforward — and that simplicity is precisely what makes it so alarming.

Step 1 — Strategic token accumulation

Over approximately two days before the proposal, the attacker systematically purchased BONK tokens on two major centralised exchanges — Bybit and Binance — spending approximately $4.4 million in total. This was not random buying — it was calculated acquisition specifically to reach the threshold required to pass a governance proposal without meaningful community opposition.

Step 2 — Malicious proposal submission

With sufficient voting power accumulated, the attacker submitted BIP-76 — a governance proposal to transfer 4.426 trillion BONK tokens (worth approximately $21.2 million at the time) from the BonkDAO treasury directly to a wallet under their control.

Step 3 — Quorum reached, proposal passed

The attacker voted “Yes” on their own proposal using the tokens they had just purchased. Because they had accumulated enough BONK to exceed the required quorum threshold — and community participation was insufficient to counter the vote — the proposal passed automatically. No hack. No exploit. Just a governance mechanism working exactly as designed, being used against the protocol.

Step 4 — Treasury drained

Following the proposal’s passage, 4.426 trillion BONK transferred from the BonkDAO treasury to the attacker’s wallet — a transaction that was fully authorised by the governance mechanism, making it technically indistinguishable from a legitimate treasury action on-chain.

The cost-benefit of the attack:

The attacker spent $4.4 million to potentially extract $21.2 million — a return of approximately 4.8x on the attack capital, executed without breaking a single line of code.

BonkDAO’s Official Statement

BonkDAO’s official account @bonk_inu confirmed the incident with the following statement:

“BonkDAO was the target of a malicious governance proposal resulting in an estimated $20M worth of BONK tokens being drained from the BonkDAO treasury. During the investigation, BonkDAO identified the exchange wallets used to purchase BONK ahead of the proposal. BonkDAO is currently actively working with exchanges, bridges and Solana Foundation to best manage the situation. Law enforcement has been notified.”

The team’s identification of the exchange wallets used for the pre-attack accumulation is a significant development — centralised exchanges like Bybit and Binance have KYC requirements that mean the attacker’s identity may be traceable. The coordination with the Solana Foundation also suggests potential network-level intervention options are being explored, though the on-chain nature of the treasury transfer significantly complicates any direct fund recovery.

Why This Attack Worked — The Governance Design Failure

The BonkDAO attack did not succeed because of sophisticated technical exploitation. It succeeded because of fundamental governance design weaknesses that made this outcome not just possible but relatively straightforward for a well-capitalised attacker.

Low quorum threshold relative to treasury value

The most critical failure: the amount of BONK required to pass a governance proposal — the quorum — was low enough that $4.4 million could purchase sufficient tokens to exceed it. For a treasury holding $21 million, the security mechanism protecting those funds required only a fraction of that value to circumvent. This is an extreme mismatch between treasury value and governance security cost.

Low community participation

Token-weighted governance depends on the assumption that the token holder community will actively participate in voting. When participation is low — as is typical for most DAO governance outside of major, contentious votes — a determined attacker does not need to outspend the entire community. They only need to outspend the active voters.

No time-lock or multi-sig protection on treasury transfers

Standard DAO security best practices include requiring either a time delay between proposal passage and execution — allowing time for the community to identify and respond to malicious proposals — or a multi-signature requirement for treasury transfers above certain thresholds. The absence of either mechanism meant the proposal executed immediately upon passage with no intervention window.

No veto or guardian mechanism

Many well-designed DAOs include an emergency pause or veto capability held by a trusted multisig committee — specifically for situations where a passed proposal appears malicious. Without this backstop, the governance mechanism had no circuit breaker once the vote concluded.

Recovery Prospects — What Happens Now

The recovery situation is complex and uncertain. The key variables:

Exchange cooperation — The attacker used Bybit and Binance for the accumulation purchases — both of which have KYC data and the ability to freeze associated accounts. BonkDAO’s statement confirms they have identified these exchange wallets, making this the most actionable near-term recovery path.

OKX deposit — The 40 billion BONK (~$188K) already deposited to OKX represents a small fraction of the total but confirms the attacker is beginning to liquidate. OKX has been cooperative in prior exploit situations across the industry.

The remaining $19.3M — The bulk of the stolen funds remain in the attacker’s wallet — which is both a risk and an opportunity. While the attacker has not yet liquidated, the BONK sitting in that wallet is visible and traceable on-chain. Any attempt to move significant amounts will be detectable.

Law enforcement — BonkDAO has notified law enforcement. Given the use of KYC-linked exchanges for the accumulation, there is a realistic path to identifying the attacker — though legal processes across jurisdictions take time.

Bottom Line

The BonkDAO attack cost the attacker $4.4 million and returned $21.2 million — a clean, code-free exploit of a governance mechanism that was not designed to protect a treasury of that size. The attacker did not break anything. They used the system exactly as intended.

BONK’s -8.80% price drop reflects the market’s immediate reaction to both the loss and the governance design questions the attack raises. Whether BonkDAO can recover the funds — through exchange cooperation, law enforcement, or attacker identification via KYC — will determine how much of the $21.2 million is ultimately returned.

The broader lesson is clear: DAO governance is not just a product feature — for any treasury holding tens of millions of dollars, it is a security mechanism that needs to be designed, audited, and stress-tested with the same rigour as the smart contracts themselves.

Written by

Nilesh Hembade

Nilesh Hembade is the Founder and Author of Coinsprobe, with 5+ years of experience in cryptocurrency and blockchain. Since launching the platform in 2023, he delivers daily, research-driven insights through market analysis, on-chain data, and technical research. His work has been featured on Binance, Bitget, and CoinMarketCap. He is also certified through Binance Academy (NFT Certificate).

›