The decentralized autonomous organization BONK DAO has fallen victim to a sophisticated governance attack. Using a malicious proposal, the attacker managed to withdraw approximately $20 million worth of BONK tokens from the treasury.
This incident has exposed a fundamental vulnerability in the architecture of many DAOs: the concentration of voting power. The attacker did not hack the smart contract code—they simply purchased enough BONK tokens to push through their desired resolution via the Realms voting system on the Solana blockchain. According to analysts, about $4 million was spent on acquiring the voting stake to prepare for the attack.
Mechanics and Consequences of the Attack
After the malicious proposal was approved, funds from the DAO treasury were transferred to wallets controlled by the attacker. The BONK team has already identified the exchange addresses used to accumulate tokens before the attack. The project is now actively cooperating with cryptocurrency exchanges, the Solana Foundation, and law enforcement agencies in an attempt to freeze and recover the stolen assets.
Part of the stolen BONK has already begun to flow into centralized exchanges, indicating the attacker's attempts to convert them into other assets. The market reacted immediately: the price of the memecoin BONK collapsed by more than 10%, demonstrating a loss of investor confidence.
Lessons for the DeFi Community
This case is not a smart contract hack but a classic example of a governance attack. It once again raises the critically important issue of DAO security. Protection mechanisms such as timelocks, multi-signatures, and delays in executing treasury decisions should become the de facto standard to prevent a single proposal from draining a protocol's reserves.
Expert Commentary from Cryptalist: The attack on BONK DAO is a wake-up call for the entire DeFi sector. While the community focuses on protecting against code hacks, attackers are finding loopholes in the very logic of decentralized governance. Investors should pay attention not only to yields but also to what treasury protection mechanisms are implemented in the protocol. Without proper checks and balances, any DAO risks becoming a victim of its own "democracy."