On June 30, a brazen attack targeted the treasury of the BONK memecoin. The attacker, having spent $4.4 million to acquire tokens, managed to withdraw assets worth $21.2 million, netting a profit of $16.8 million. This incident exposed a fundamental flaw in the project's decentralized governance (DAO) mechanisms.

Attack Mechanics: How It Worked

The hacker prepared for the operation over two days. They purchased 882 billion BONK on the Bybit and Binance exchanges, spending $4.4 million. This volume of tokens was sufficient to exceed the required quorum for approving a proposal in the DAO — 879 billion BONK. Subsequently, the attacker submitted a proposal to transfer 4.426 trillion BONK ($21.2 million) from the treasury to a wallet under their control (9bxW…JHvQ) and voted "yes" using all their tokens.

The proposal was automatically approved, as the voting system is tied to the number of tokens in a wallet. This is a classic attack on a DAO, where it is enough to amass a certain voting weight, while the code itself remains secure. The root of the problem lies in the project's governance system, not in the security of the smart contracts.

Current Status of Stolen Funds

Part of the assets has already been moved. As of publication, analysts are tracking the distribution:

  • 40 billion BONK ($188,000) transferred to the OKX exchange.
  • 4.386 trillion BONK ($19.3 million) remain in the wallet EXaJnm…eh42.

The hacker is not rushing to withdraw the remaining funds, which may indicate an attempt to avoid close scrutiny or a wait for a more favorable exchange rate. Analysts continue to monitor the specified address.

Expert Opinion: This incident is a stark reminder that even projects with "secure" code can have critical vulnerabilities at the governance level. DAO structures where voting is tied to tokens are particularly vulnerable to "51%" attacks or quorum manipulation. Projects need to implement multi-layered protection mechanisms, including execution delays, multi-signatures, and dynamic changes to quorum requirements. Without this, the treasury of any DAO remains an easy target for those willing to invest in an attack.