What to Know
- $20 million was drained from BonkDAO’s treasury after a malicious governance proposal executed automatically on July 6.
- An attacker spent about $4.4 million buying BONK on exchanges to hit the 1% quorum needed to pass the vote.
- The proposal, titled “BIP #76, Sowellian BonkDAO,” passed with a 99.9% yes vote cast by just seven wallets.
- BONK’s price fell about 7% in the 24 hours after the drain, according to market data.
A BONK treasury drain wiped out roughly $20 million from the memecoin’s decentralized governance body late Monday, after an attacker spent days quietly buying enough tokens to rig a vote almost nobody was watching. BonkDAO, the decentralized autonomous organization that governs BONK, saw its entire treasury balance move to an outside wallet the moment a proposal called “BIP #76” cleared quorum by the thinnest possible margin. Every transaction involved was technically legal. That’s the part that stings.
How the BONK Treasury Drain Unfolded
BONK is a Solana-based memecoin, and BonkDAO is the decentralized autonomous organization that governs its treasury. Those votes run through Realms, the Solana governance platform BonkDAO uses to submit and execute proposals like BIP #76. Token holders vote on proposals instead of a company making the calls, and if a vote clears quorum, the outcome executes automatically onchain. No committee reviews it. No one hits pause. That structure, built to remove middlemen, turned out to be the exact weapon someone used to empty the treasury.
The setup took a week. On June 30, an anonymous wallet submitted a proposal to transfer the DAO’s holdings to a wallet it controlled. To pass, the proposal needed yes votes equal to 1% of BONK’s total supply, the quorum required for automatic execution. Over July 4 and July 5, a separate wallet quietly assembled exactly that much voting power, buying BONK on the exchanges Bybit and Binance and, by one account, borrowing additional tokens through DeFi lending platforms.
Buying and borrowing are doing a lot of work in that sentence. Reaching 1% of a token’s entire circulating supply in five days without moving the price too obviously takes real capital, and $4.4 million split across Bybit and Binance, plus borrowed funds pulled from DeFi lending platforms, is exactly the kind of spend that should trip alarms on a treasury this size. It didn’t. Nobody flagged the accumulation until the vote had already passed.
- June 30, Anonymous wallet submits BIP #76 to transfer BonkDAO’s treasury
- July 4-5, Attacker spends $4.4 million buying and borrowing BONK to reach quorum
- July 6, Proposal passes with 882.38 billion BONK votes against an 879.95 billion threshold
- 9 hours later, $19 million moves to a multisig wallet, $188,000 sent to an exchange
- About an hour after that, attacker begins selling the BONK stake, offloading $5.3 million
What Is BIP #76 and Why Did It Pass?
BIP #76 is the onchain governance proposal, titled “Sowellian BonkDAO,” that authorized transferring BonkDAO’s entire treasury to a single wallet. It passed on July 6 with a 99.9% yes vote, but only seven wallets actually voted, against more than 18,000 DAO members who didn’t, a turnout of just 2.9%.
It cleared quorum by 882.38 billion BONK in favor against an 879.95 billion threshold, almost exactly the stake the attacker had spent days assembling. Read that number twice. The margin of victory was, essentially, one voter agreeing with itself.
Beneath the pitch sat the only line that should have raised alarms: a transfer of 4.43 trillion BONK to the attacker’s wallet. You can read the BIP #76 Sowellian BonkDAO proposal onchain, votes and all, because nothing about it was hidden. That’s what makes this different from a hack. Nobody broke in. They filled out a form and waited.
That pitch reads less like a governance motion and more like a sales page. Promises to rebuild, monetize, and stop the bleeding are the kind of language you’d expect from a project asking for more funding, not from a wallet about to walk away with someone else’s treasury.
Rebuild from the ashes, monetize holdings, stop the bleeding. All YES voters are eligible to receive tokens.
BonkDAO’s Response and the Aftermath
BonkDAO has confirmed the attack, describing it in a statement as a malicious governance proposal that drained an estimated $20 million from its treasury. The team said it identified the exchange wallets used to buy tokens ahead of the vote and is now working with exchanges, bridges, and the Solana Foundation to manage the fallout. Anyone can check BonkDAO’s own statement on the $20 million treasury drain directly on its site.
The attacker didn’t sit on the prize. Nine hours after the drain, about $188,000 moved to an exchange, likely an attempt to cash out, while the remaining $19 million landed in a multisig wallet that requires multiple signers to move funds, according to Chainalysis. Just over an hour later, the same wallet started selling the BONK it had bought to rig the vote in the first place, offloading roughly $5.3 million worth. It kept the treasury tokens. It ditched the stake it used to steal them.
Chainalysis and Lookonchain, the blockchain analytics firms that traced the wallets in real time, are the same kind of outfits law enforcement leans on when crypto theft crosses into an actual investigation. BonkDAO looping in bridges alongside exchanges and the Solana Foundation matters because $19 million sitting in a multisig wallet doesn’t stay put forever, and cross-chain bridges are the most common route stolen crypto takes to get somewhere harder to trace.
Is This Theft or Just Exploiting the Rules?
Call it what you want, theft, exploit, or governance failure, but the attacker never broke a single rule written into BonkDAO’s code. Every step, the buying, the vote, the payout, was a legitimate onchain transaction. Some onchain observers have argued that’s exactly the point: nothing was hacked, so nothing was technically stolen, just a weak governance design that finally got tested.
That argument doesn’t hold up past the first read. BonkDAO calls it an attack. Analytics firms tracking the wallets call it an attack. Law enforcement’s involvement tells you which side of that debate is winning. A treasury that can be emptied by whoever assembles a temporary voting majority was never secure to begin with, it was just unattacked. The cost of buying that majority here was $4.4 million. The prize was $20 million. That math was always going to attract someone.
What This Means for BONK Holders
For anyone holding BONK, the immediate damage shows up in the chart, not just the treasury balance. BONK prices fell about 7% in the 24 hours following the attack, according to market data on BONK’s price, as traders priced in both the drained treasury and the uncomfortable question of what “decentralized governance” actually protects against.
The bigger risk isn’t the 7% dip. It’s every other DAO running the same low-quorum design, watching this happen to a memecoin with real trading volume and wondering if it’s next. BonkDAO’s quorum sat at 1% of supply, a number that looked safe until someone did the math on how cheap that 1% actually was. If you’re holding a governance token anywhere, that math is worth checking today, not after your own treasury vote passes at 3 a.m. with seven wallets deciding your fate.
Memecoins already carry enough volatility on a normal day. Layering a treasury that any sufficiently funded wallet can vote its way into on top of that is a different kind of risk entirely, one that has nothing to do with chart patterns and everything to do with code nobody stress-tested against a motivated attacker.
Frequently Asked Questions
What happened to BonkDAO's treasury?
BonkDAO’s treasury lost about $20 million on July 6 after a malicious governance proposal, BIP #76, passed and automatically transferred 4.43 trillion BONK to an attacker’s wallet. The attacker spent roughly $4.4 million buying BONK to reach the 1% quorum needed for the vote to execute.
How did the attacker pass the malicious BONK proposal?
The attacker bought and borrowed enough BONK on exchanges like Bybit and Binance to control 1% of total supply, the quorum threshold. With only seven wallets voting, the proposal passed with a 99.9% yes result against 18,000 members who didn’t participate.
Is the BonkDAO treasury drain considered a hack?
BonkDAO and blockchain analytics firms describe it as an attack, since it drained the treasury through deception rather than a technical breach. Every transaction was valid onchain, but law enforcement involvement and BonkDAO’s own statement treat the incident as theft, not a fair governance outcome.
How much did BONK's price drop after the attack?
BONK’s price fell about 7% in the 24 hours following the treasury drain, according to market data, as traders reacted to the loss of $20 million from the DAO’s holdings. The drop also reflected doubts about whether BonkDAO’s governance design, which required just 1% of supply to pass a proposal, can protect the treasury from similar attacks.
This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.
$4.4M to push a malicious proposal through and walk away with $20M is a 4.5x return on the attack cost. That math alone tells you the quorum threshold was way too low relative to treasury size.
so nobody on the multisig noticed a $4.4m wallet suddenly voting yes on a treasury drain? governance theater at its finest
Been in memecoins since the SHIB days and this is the exact playbook. Once treasuries get big enough, the governance token float becomes the actual attack surface. BONK is not the first and definitely not the last.
twenty million gone because voting was cheaper than stealing directly
Curious if anyone knows whether the malicious proposal had a timelock or if execution was immediate after passing. That detail changes whether this was preventable or not.
People keep calling this a hack but it followed the rules of the DAO exactly as written. If your governance can be bought for 22 cents on the dollar, that is a design failure, not an exploit.