BONK DAO's £16m Treasury Drained in Governance Attack

The BONK decentralised autonomous organisation (DAO), built on the Solana blockchain, has suffered a significant blow, with an attacker successfully draining approximately £16 million (around $20 million) from its treasury. This incident, which unfolded over a week, highlights the inherent vulnerabilities within token-based governance systems, sparking renewed debate within the cryptocurrency community. The attacker meticulously exploited BONK DAO’s on-chain governance mechanism. By investing roughly £3.5 million (about $4.4 million) to acquire just over one percent of BONK’s total supply, they met the crucial quorum threshold required to pass a malicious proposal. This effectively granted them decisive voting power in a low-turnout ballot, which ultimately passed with an overwhelming 99.9 percent 'yes' vote. The sequence of events began on June 30th when an anonymous wallet submitted a proposal to transfer the DAO's treasury holdings to an address it controlled. To ensure success, the proposal needed 'yes' votes equivalent to one percent of BONK's supply – the minimum participation or quorum. Between July 4th and 5th, a separate wallet then acquired precisely this amount, spending the aforementioned £3.5 million on exchanges such as Bybit and Binance, and reportedly borrowing additional tokens via DeFi lending platforms. This 'BIP #76 - Sowellian BonkDAO' proposal passed with a mere seven wallets voting in favour, in stark contrast to the over 18,000 members who did not participate. The turnout was a dismal 2.9%, with the proposal clearing the quorum by the narrowest of margins: 882.38 billion BONK in favour against an 879.95 billion threshold. BONK DAO operates as a governance structure where token holders collectively vote on proposals, rather than a centralised company making decisions. While this model was once lauded as the future of community self-governance, this multi-million-pound attack on the memecoin demonstrates the potential risks when treasuries are subject to public votes where a temporary voting majority can be cheaply acquired. The incident has reignited discussions on whether such actions constitute outright theft or merely the exploitation of design flaws within the governance rules. Each step taken by the attacker – from buying the tokens to voting and initiating the payout – was a legitimate on-chain transaction. However, the cumulative effect was the effective siphoning of substantial funds from the treasury. In the aftermath of the attack, BONK prices have experienced a seven percent decline over the past 24 hours, according to market data. This event serves as a stark reminder of the evolving security landscape in the decentralised finance (DeFi) arena and the critical need for robust, unexploitable governance frameworks to protect digital assets.