Onchain governance was heralded a few years ago as the future of how communities run themselves. But a multimillion attack on the memecoin $BONK shows the cost of putting a treasury at the mercy of a public vote anyone can buy their way into.
$BONK DAO was drained of $20 million late Monday, the culmination of a week-long scheme in which an opportunistic attacker spent about $4.4 million buying up the project's bonk tokens to force through a vote. Every step was a legitimate transaction — such as the buying, the vote, the payout — and together they carried out a theft.
$BONK is a Solana-based memecoin, and $BONK DAO is the decentralized autonomous organization that governs it, a structure where token holders vote on proposals rather than a company making decisions. Anyone holding enough tokens can propose a change and, if a vote passes, have it execute automatically onchain.
That design was the specific weapon used in this attack.
The sequence began on June 30, when an anonymous wallet submitted a proposal to transfer the treasury's holdings to a wallet it controlled, per Chainalysis. To pass, the proposal needed yes votes equal to 1% of $BONK's supply, the quorum, or minimum participation, required for it to take effect.
Over July 4 and 5, a separate wallet acquired exactly that much, spending about $4.4 million to buy $BONK on the exchanges Bybit and Binance and, by one account, borrowing more through DeFi lending platforms, according to Lookonchain.
Titled "BIP #76 - Sowellian BonkDAO," the proposal passed with just seven wallets voting, against more than 18,000 members who did not, a turnout of 2.9%.
It cleared quorum by the narrowest margin, 882.38 billion $BONK in favor against a 879.95 billion threshold, almost exactly the stake the attacker had spent days assembling.
The 99.9% "yes" result was effectively a single voter agreeing with itself. Its written pitch read less like a governance motion than a boast, promising to "rebuild from the ashes, monetize holdings, stop the bleeding," with a line noting that "all YES voters are eligible to receive tokens."
Beneath it sat the only instruction that should have turned heads - a transfer of 4.43 trillion $BONK to the attacker's wallet.
By July 6 the voter held just enough. It cast its entire stake in favor, the proposal passed, and about $20 million in $BONK automatically moved out of the treasury into the attacker's wallet.