BonkDAO, the community organization behind the Solana-based memecoin BONK, lost approximately $20 million in BONK after an attacker bought voting power to pass a malicious proposal. The attacker spent around $4.4 million to accumulate the necessary voting power, which was used to transfer the majority of the treasury to a wallet controlled by the attacker. The proposal, submitted on June 30, was titled BIP #76 and claimed to be a governance renewal plan, but its sole purpose was to drain the treasury.
Attack Mechanics
The attacker methodically accumulated voting power over six days, purchasing BONK through exchange wallets to reach the quorum threshold. On-chain researchers later reconstructed the accumulation pattern, showing that the attacker bought the exact number of votes required to pass the proposal. The final tally showed 882.38 billion BONK in favor, with a yes share of 99.9% and a turnout of 2.9%.
Aftermath
The attack has raised concerns about the security of DAO governance systems, particularly those that use token-weighted voting. The lack of safeguards, including a timelock, multisig or council veto, and quorum and participation design, allowed the attacker to execute the malicious proposal without opposition. The incident has sparked a philosophical debate about whether the attack constitutes theft, with some arguing that the attacker simply exploited the existing governance system.
Broader Implications
The attack on BonkDAO highlights a deeper issue with DAO governance systems, where the cost of controlling a treasury can be a fraction of its value. This vulnerability is not unique to BonkDAO, as seen in the 2022 attack on Beanstalk, where an attacker used a flash loan to seize voting control and drain $180 million. The incident has implications for the wider DeFi industry, where vote buying and bribery are normalized and infrastructure exists to support these activities.
Based on reporting from crypto.news.
