An anonymous wallet spent $4.4 million buying BONK tokens over two days to push through a governance vote that drained $21.2 million from BonkDAO’s treasury, netting a $16.8 million profit. The attacker filed a proposal on June 30, then acquired enough tokens to meet the 1% quorum requirement, voted “yes,” and transferred the funds to a wallet they controlled. BonkDAO confirmed the loss, alerted law enforcement, and is coordinating with exchanges. The incident has split the crypto community, with some calling it theft and others arguing the DAO functioned as designed.
BonkDAO confirmed the treasury loss in a statement posted on X, stating it had identified the exchange wallets used to acquire the voting tokens and had notified law enforcement while coordinating with exchanges, bridges, and the Solana Foundation to “manage the situation.”
According to blockchain analytics platform Lookonchain, preparations for the theft started on June 30 when the attacker filed a proposal asking BonkDAO to move 4.426 trillion BONK, worth about $21.2 million, to a wallet they controlled. The proposal required support from at least 1% of the BONK supply, which stands at just under 88 trillion tokens per CoinGecko data.
From around July 4, the attacker bought 882.285 billion BONK on Bybit and Binance, just enough to clear the 1% quorum requirement of 879.95 billion tokens. They then voted “yes” with all 882.285 billion BONK, passing the proposal, after which 4.426 trillion tokens were transferred to their wallet.
Chainalysis corroborated Lookonchain’s account, stating the attacker acquired tokens between July 4 and 5, buying some from exchanges and borrowing others through DeFi platforms. About nine hours after the vote, the attacker sent $188,000 to OKX while putting the rest in a new DAO, “BONK 2.0,” controlled by the malicious voter, the exploiter wallet, and a third wallet with financial ties to the voter.
Following news of the theft, BONK traded around $0.00000438, a 7.4% 24-hour drop but still up nearly 5% on the week. The event continues a trend reported by CryptoRank showing DeFi platforms losing nearly $1 billion to bad actors this year.
World Liberty Financial advisor Ogle questioned why law enforcement had become involved, writing on X: “Someone legitimately bought a lot of tokens, proposed a DAO vote, the vote passed with almost no opposition, and the proposal was executed.” Ogle added that reports claiming the voting website was inaccessible during the period, if true, would raise separate concerns but did not make the on-chain vote illegal.
Ripple CTO Emeritus David Schwartz argued that using voting control over a shared treasury for personal gain could amount to fraud, as governance participants owe a fiduciary duty to other stakeholders. He stated that BonkDAO’s lack of a formal legal wrapper could expose participants to partnership-style liabilities in some jurisdictions.
