On June 30, 2023, one of the most sophisticated attacks on decentralized governance in cryptocurrency history occurred. The attacker, exploiting a vulnerability in the DAO voting mechanism, managed to withdraw BONK tokens worth $21.2 million from the project's treasury. Their own preparation costs for the operation amounted to just $4.4 million, with a net profit of $16.8 million.

How the Attack Was Constructed

Two days before the attack, the hacker purchased 882 billion BONK tokens on the Bybit and Binance exchanges, spending $4.4 million. This volume was sufficient to exceed the required quorum of 879 billion BONK for proposal approval. The attacker then submitted a proposal to the DAO to transfer 4.426 trillion BONK ($21.2 million) to a wallet under their control, 9bxW…JHvQ, and voted "yes" with their entire holdings.

Since the project's governance system is tied to the number of tokens in a wallet, the proposal was automatically approved. The funds were instantly moved to the attacker's address.

Current Status of the Stolen Funds

At the time of analysis, some of the assets had already changed addresses. Out of 4.426 trillion BONK:

  • 40 billion BONK ($188,000) were transferred to the OKX exchange;
  • 4.386 trillion BONK ($19.3 million) remain in the wallet EXaJnm…eh42.

It appears the hacker is in no rush to withdraw the remaining funds. They may be waiting for more favorable market conditions or preparing the next move.

The Root of the Problem Lies in Governance, Not Code

Members of the crypto community rightly noted that this time the issue is not a vulnerability in smart contracts, but in the project's governance architecture. The code itself remained secure, but the voting mechanism, where each token grants voting power, allowed the attacker to concentrate enough influence for manipulation.

This incident is a serious signal for all projects using DAOs. Token-based governance without additional protective mechanisms (such as time delays or multi-level approval) remains one of the weakest points in the DeFi ecosystem.

Expert Opinion: This attack demonstrates a fundamental problem with many DAOs—the concentration of power in the hands of large token holders. Until projects implement more sophisticated governance systems, such as delegated voting or quadratic voting, similar incidents will recur. BONK was fortunate that the damage was limited to $16.8 million—it could have been much worse.