Governance Attack on Cash Capability: How $20 Million in BONK was "Legitimately" Stolen?

Written by: KarenZ, Foresight News

If someone tells you that they didn’t hack into anyone's computer, didn’t exploit any code vulnerabilities, and didn’t even tell a single lie, but boldly took nearly $20 million worth of tokens from a DAO’s treasury — you would certainly think they are bragging.

But this really happened in the world of Web3.

The leading Meme project in the Solana ecosystem, BonkDAO, suffered a governance attack. The attacker did not employ any sophisticated hacking techniques but perfectly exploited the survival rule of "one token, one vote" in decentralized governance to steal nearly $20 million worth of BONK tokens.

On July 7, 2026, Beijing time, the official BONK account disclosed on X that BonkDAO had encountered a malicious governance proposal, which led to approximately $20 million worth of BONK being transferred out of the treasury. The officials also stated that they had identified the exchange wallets that bought BONK before the proposal and were working with exchanges, cross-chain bridges, and the Solana Foundation to address the situation.

The Brazen Theft Dressed as "Governance"

The governance page related to this incident corresponds to a proposal BIP #76 - Sowellian BonkDAO submitted on June 30 on Realms. This proposal stated that it intended to implement a so-called "Sowellian" governance plan, replacing members and committees, reconstructing the DAO, liquidating holding positions to stop losses, and issuing tokens to all who voted in favor.

If we peel away these fancy industry terms, it simply translates to: "I request that all over 4.4 trillion BONK tokens (worth $20 million) in the treasury be fully allocated to my address."

Ironically, the term Sowellian in the governance proposal's name refers to the governance prediction market system name on the Solana governance platform Realms (which is the underlying system where BONK held this vote). Realms designed this Sowellian mechanism with a noble intention: to introduce economic games, allowing participants to vote on proposals with real money, thus "rewarding good decisions and penalizing bad decisions and malicious attacks."

As a result, the attacker deliberately named this blatant "robbery" of the treasury as "Sowellian BonkDAO." The attacker used the platform's proudest "game rules" to take away the assets of a DAO treasury.

$4.4 Million Principal to Bet $20 Million: The Attacker’s Math Problem

After the proposal was initiated on June 30, the "attacker" adopted an extremely simple and crude method of cash capability that could not be intercepted by smart contracts:

1. **Secretly Accumulating Tokens:** According to statistics, in the past few days, the "attacker" collected a total of 882.285 billion BONK from Binance and Bybit, meeting the minimum voting requirement (at least 1% of tokens), worth $4.4 million on-chain.

2. **Voting:** This on-chain address cast a vote in favor on the Realms governance system. However, due to the very low participation of BonkDAO's daily governance, only 7 addresses participated in the vote. This address used 882.285 billion BONK to cast 99.878% of the voting weight, gaining an overwhelming "absolute controlling stake" due to its absolute advantage.

On June 6, the voting results were announced: the proposal passed. The smart contract automatically transferred 4.4 trillion BONK (approximately $20 million) from the treasury to the attacker’s pocket according to the established rules.

Where Did the DAO's Defense Mechanism Go?

You might wonder: Is there really no limit? Can they vote and then directly take the money away?

This is precisely the fatal mistake made by BonkDAO. In relatively mature DAO governance, there are usually several defense lines:

• Voting Validity Threshold: Proposals involving the transfer of core assets from the treasury must significantly raise the requirements for the number of voters and approval rates to prevent a few individuals from storming in.
• Timelock: After a proposal is passed, it must be locked for 3 to 7 days before execution. During this period, if the community discovers that this is a malicious proposal, multisig administrators or the core team have time to use the "veto" power to block it or urgently modify the contract.
• Delayed Voting Mechanism: To prevent someone from manipulating the results at the last moment before the voting deadline using flash loans or large sums of money.

Unfortunately, BonkDAO lacked sufficient defensive buffers and multisig intervention mechanisms, leading to the immediate execution of malicious proposals after passage. Once the attacker succeeded, they quickly transferred the funds.

Conclusion

With a $4.4 million chip, they legally "voted" out $20 million in front of an unattended ballot box.

The Bonk governance attack has sounded the alarm for the entire Web3 industry. This is not a code vulnerability in smart contracts, but a pure "governance manipulation and economic game," also highlighting the absence of governance logic and rules.