BonkDAO Loses $20 Million After Malicious Governance Proposal Drains Treasury

Highlights:

• An attacker spent about $4.4 million to gain enough voting power and drain more than $21 million from the treasury.
• The BonkDAO treasury breach exposed how token-weighted governance can become a security risk.
• BONK has fallen about 10% after the attack as investigators work with exchanges to trace the stolen funds.

BonkDAO, the decentralized autonomous organization behind the Bonk memecoin, has disclosed that attackers drained about $20 million in tokens after pushing through a malicious governance proposal. The organization announced the breach on Monday in a post on X, saying the unauthorized measure allowed an unknown entity to transfer assets from its Solana treasury.

BonkDAO Hit by Governance Attack as $4 Million Vote Push Drains $20 Million

BonkDAO, the governance body behind BONK, one of Solana’s largest memecoin ecosystems, said it was hit by a malicious governance proposal that led to about USD 20 million worth of BONK being drained from…

— Wu Blockchain (@WuBlockchain) July 7, 2026

The DAO said it reported the theft to law enforcement after confirming the unauthorized transfer. It also said it is working with cryptocurrency exchanges, cross-chain bridges, the Solana Foundation, and investigators to trace the stolen assets, recover the funds, and identify those responsible. In addition, investigators have identified exchange wallets that accumulated tokens before the proposal appeared on Solana’s Realms governance platform. Those wallets have become a key focus of the ongoing investigation.

How the Attacker Drained the BonkDAO Treasury

According to Lookonchain, the attacker spent about $4.4 million to steal roughly $21.2 million worth of BONK from the BonkDAO treasury, generating an estimated profit of $16.8 million. The blockchain analytics platform said the attacker carried out the exploit through BonkDAO’s governance system instead of exploiting the Solana blockchain or compromising user wallets.

Someone spent $4.4M to steal $21.2M from the #BONK treasury, making a profit of $16.8M.

How did it happen?👇

➡️ On June 30, the attacker submitted a governance proposal to transfer 4.426T $BONK($21.2M) from the treasury to a wallet he controlled (9bxW…JHvQ).… pic.twitter.com/VElnDuazki

— Lookonchain (@lookonchain) July 7, 2026

The attacker submitted a governance proposal on June 30 seeking to transfer 4.426 trillion BONK from the treasury to a wallet under his control. During the following two days, the attacker bought 882.285 billion BONK on Binance and Bybit. That amount exceeded the 879.95 billion BONK quorum required for the proposal to pass on Solana’s Realms governance platform.

After securing enough voting power, the attacker voted in favor of the proposal using all 882.285 billion BONK. The proposal later received enough support and automatically transferred 4.426 trillion BONK to the attacker’s wallet.

Lookonchain also said the attacker has already started moving the stolen tokens. The analytics platform reported that the attacker deposited 40 billion BONK, worth about $188,000, into OKX. Meanwhile, the remaining 4.386 trillion BONK, worth about $19.3 million, remains in another wallet at the time of reporting.

The exploit has also triggered an immediate market reaction. Upbit temporarily suspended BONK deposits and withdrawals after identifying suspicious activity linked to the stolen funds. Meanwhile, BONK is down 10.84% over the past 24 hours and is trading near $0.000004274. However, the trading volume is up 254.64% to $136 million, with the market cap sitting at $376.13 million.

Governance Attacks Keep Hitting DeFi Projects

The incident joins a growing list of DAO takeovers and decentralized finance exploits that have targeted protocol funds. Earlier, the Beanstalk protocol lost about $180 million after an attacker used flash loans to gain temporary voting power and approve a malicious proposal within seconds. Compound Finance also faced controversy after a governance proposal redirected roughly $24 million worth of COMP tokens despite objections from several delegates.

Other decentralized finance platforms have also suffered major security incidents through different attack methods. Memecoin launch platform DxSale disclosed a cyberattack that drained about $7.3 million in assets from liquidity providers on BNB Chain.

#PeckShieldAlert Tahax reported that @DxSale was drained ~$7.3M from 1,400 @BNBCHAIN LPs.

The address 0xC457…FA69 transferred a total of 2,958 $BNB (~$1.87M) to 2 main wallets, and subsequently deposited to multiple #Binance deposit addresses. pic.twitter.com/mQRO3zwuBT

— PeckShieldAlert (@PeckShieldAlert) May 29, 2026

Meanwhile, blockchain security firm Blockaid also detected an active exploit that drained roughly $6 million from Summer.fi before investigators released a technical explanation. The company later identified another smart contract exploit affecting ShapeShift’s FOX Colony on Arbitrum.