BonkDAO Loses $20M in Governance Attack as Attackers Vote Themselves Funds

How the Exploit Unfolded

The attackers first accumulated a large amount of BONK tokens through exchange wallets. They then submitted a proposal called "Sowellian BonkDAO" that required only a 1% community vote threshold to pass. Once approved on-chain, the proposal authorized the transfer of approximately 4.4 trillion BONK tokens, valued at around $20 million at the time, directly to the attackers' wallet.

BonkDAO stated the exploit targeted its governance process rather than the underlying Solana blockchain. The project quickly confirmed the incident via its official channels and noted that stolen funds began moving toward multiple cryptocurrency exchanges.

Market Reaction and Price Impact

BONK experienced immediate selling pressure following news of the exploit. The token price fell between 7% and 10% within hours, with trading volume spiking as markets reacted to the treasury drain. South Korean exchange Upbit temporarily suspended BONK deposits and withdrawals to monitor and contain any flow of stolen tokens.

Despite the setback, on-chain data indicated that large whale wallets continued accumulating BONK in the weeks leading up to the event, with only minimal reductions in holdings from a small number of addresses. This suggests some investor confidence remained intact even after the news broke.

Response from BonkDAO and Partners

BonkDAO notified law enforcement agencies and is collaborating with the Solana Foundation, bridges, and various exchanges to trace the stolen assets and pursue recovery. The team emphasized ongoing efforts to identify those responsible and mitigate further damage.

Security analysts pointed to the low voting threshold and lack of additional safeguards, such as time locks or multi-signature requirements for treasury movements, as key weaknesses. One researcher noted the configuration made large transfers vulnerable to manipulation.

Broader Implications for DAOs

This incident adds to a series of governance-related attacks in the crypto space. Critics argue that efforts to encourage broad community participation through low barriers can sometimes come at the expense of basic security measures. Similar exploits in other projects have shown how voting systems can be gamed when treasury controls lack sufficient protections.

Bonk, a dog-themed memecoin launched on Solana in late 2022, built its reputation through community airdrops and exchange listings. The project holds a notable position in the memecoin sector, but this event marks its first major security incident of this scale.

The full impact on BonkDAO's operations and long-term holder sentiment will depend on the success of recovery actions and any further updates from the team.