BonkDAO treasury drained of $20M through governance exploit
Security & Exploits ·
An estimated $20M in BONK tokens was withdrawn from the BonkDAO treasury after a malicious governance proposal passed largely unnoticed, with the funds now moving toward exchanges.
BonkDAO disclosed the incident in a statement, saying it was targeted by a malicious governance proposal that resulted in an estimated $20M worth of BONK being drained from its treasury, according to the official BonkDAO post. The mechanism involved manipulating the DAO's proposal process rather than a direct smart-contract exploit, allowing the attacker to authorize the transfer of treasury funds under the guise of legitimate governance.
During its investigation, BonkDAO said it identified exchange wallets that had been used to purchase BONK ahead of the proposal being submitted, suggesting the attacker may have positioned tokens in advance. The DAO said it is now actively working with exchanges, bridges, and the Solana Foundation to manage the fallout and trace the movement of funds, per the same statement.
The exploit has been corroborated across multiple outlets, with The Block reporting that BonkDAO lost $20 million following the malicious governance proposal attack. Separate coverage from the cluster indicates the drained BONK has begun moving toward exchange wallets, and that at least one exchange, Upbit, suspended BONK deposits and withdrawals in response. Other reports in the cluster describe attackers as having been identified via exchange wallet activity, though BonkDAO's own statement stops short of naming any individual or entity as responsible.
BonkDAO said law enforcement has been notified and that it continues to work with relevant parties to recover the funds and identify those responsible. Wu Blockchain is among the outlets tracking developments in the case.
What remains unresolved is whether any of the $20M can be recovered, whether exchanges will freeze the identified wallets before further funds move, and whether law enforcement or the Solana Foundation will name those behind the proposal. The cluster also notes public accusations traded between executives at Ether.fi, though the connection between that dispute and the BonkDAO exploit itself has not been detailed in the available material.