An Attacker Spent $4M on Votes and "Legally" Drained $20M From BONK's Treasury

On July 7, 2026, roughly $20 million disappeared from the treasury of BonkDAO — the organization behind the Solana meme token BONK. But this wasn't a smart-contract hack — it was a governance attack: the attacker got the money through an official vote they orchestrated themselves, CoinDesk reports.

What a governance attack actually is: in a DAO (a decentralized autonomous organization), decisions are made by voting, where voting power is proportional to how many tokens a participant holds. If someone buys up enough tokens, they can pass literally any proposal — including sending the entire treasury to their own wallet — and it's technically "legitimate," because the code simply executes whatever the majority voted for.

How it was pulled off: the attacker spent roughly $4 million buying tokens on exchanges ahead of time, securing a dominant share of the vote. The malicious proposal sat live for 6 days, but only 7 wallets ended up voting — and wallets tied to the attacker controlled 99.878% of that vote, The Defiant notes.

More than 4.4 trillion BONK tokens (worth about $19.3 million at the time) moved from the treasury wallet to an address ending in "JHvQ," funded via a Bybit account according to Solscan, then onward to another address, The Record notes. The project team is now working with exchanges and the Solana Foundation, law enforcement has been notified, and exchanges Upbit and Kraken have paused BONK deposits and withdrawals.

What this means in practice: this kind of scheme only works where a vote has no minimum quorum and no time delay before execution — and most DAOs still don't build in that protection, crypto.news explains. We've covered a similar principle — manipulating the rules rather than breaking the code — in our earlier coverage of the DOJ's crypto price-pumping charges.

This article is for informational purposes only and does not constitute investment advice.