BONK DAO has confirmed a large-scale attack on its governance mechanism, resulting in approximately $20 million worth of BONK tokens being drained from the treasury. This incident serves as another alarming signal for the entire decentralized governance ecosystem.
The attacker employed a sophisticated tactic: they purchased approximately $4 million worth of BONK tokens to secure enough voting power to pass a malicious proposal. After approval via the Realms platform on the Solana network, the proposal enabled the transfer of about $20 million from the DAO treasury to wallets controlled by the attacker.
Attack Mechanics and Market Reaction
Unlike traditional smart contract exploits, no code vulnerability was used here — it was a legitimate but malicious voting procedure. The BONK team has already identified the exchange wallets used to accumulate voting power before the attack and is actively cooperating with cryptocurrency exchanges, the Solana Foundation, and law enforcement agencies.
The market reaction was immediate: the BONK token lost more than 10% of its value amid panic among holders. Part of the stolen funds has already begun moving to cryptocurrency exchanges, indicating the attacker's attempts to liquidate assets.
Lessons and Outlook
This incident once again raises fundamental questions about DAO security. Protection mechanisms such as timelocks, multi-signatures, and delays on treasury execution decisions should become a de facto standard for all protocols. Without them, a single malicious proposal can drain reserves, as happened with BONK.
Investors are now focused on whether the funds can be recovered and what new governance mechanisms will be implemented to prevent similar attacks in the future. The market expects concrete actions, not just promises.
Expert comment from Cryptalist: The attack on BONK DAO is a classic example of how "decentralization" can turn against the community if not backed by robust protection mechanisms. Acquiring voting power to execute a malicious transaction is not a hack but an exploitation of the very essence of DAOs. Projects that fail to implement a multi-layered treasury transaction approval system will have to learn from BONK's bitter experience.