According to multiple sources citing on-chain analyst Yu Jin's data, about 13 days ago, the attacker's address gained control over a governance proposal and transfered approximately 4.426 trillion BONK from the Bonk project treasury in one go. Subsequently, it continued to sell in batches on the secondary market, and after the last transfer of around 400 billion BONK (about $1.17 million) to Coinbase on July 20, 2026, the overall position was seen as fully liquidated. In terms of funding, a single source claimed that the attacker invested approximately $4.4 million upfront to acquire BONK in order to gain sufficient governance voting power, while the total cash-out from emptying and selling the treasury amounted to approximately $13.58 million, creating a significantly higher profit margin than the initial investment. In recent days, the address’s continuous selling pressure on BONK was interpreted by the market as putting clear pressure on the BONK price, but public materials did not disclose specific declines or trading volume data. What is more certain is that this governance attack concerning the treasury has completely followed the on-chain path of “buying chips – controlling votes – transferring out treasury – concentrated liquidation,” thus bringing the governance security and voting power concentration issues of Bonk to the forefront.
$4.4 million to buy votes and siphon the treasury: Restoration of the attack path
According to AiCoin data, the starting point of this entire incident occurred about 13 days ago, where the attacker’s address concentrated on buying BONK on-chain in a very short time, accumulating around $4.4 million. This capital was not intended for long-term holding, but clearly aimed at Bonk's governance mechanism -- under the current voting rules, holding BONK at this magnitude allows reaching the threshold for passing treasury-related proposals, with the actual effect being that a medium-sized investment essentially "bought" the voting rights for key issues. Following this, the address quickly participated in the governance process, advancing and controlling a governance proposal related to the treasury with sufficient token advantages.
When the proposal entered the voting stage, the attacker easily gained majority support due to concentrated chips, and the proposal passed smoothly, triggering core on-chain actions at the treasury level. According to AiCoin data, after the proposal passed, the official Bonk treasury address transferred approximately 4.426 trillion BONK to the attackercontrolled personal address, and the flow of tokens was clearly visible on-chain: funds flowed directly from a single treasury address to the attacker’s address without complicated intermediate splits or concealment paths. This means that with just about $4.4 million spent upfront to buy votes, one can leverage several times the treasury assets within the compliance framework of the governance process, showing that structural flaws such as low voting thresholds and excessive power concentration were amplified into a governance attack that could substantially empty the treasury.
4.426 trillion BONK escapes in batches: A complete record of CEX liquidation
After obtaining the approximately 4.426 trillion BONK transferred from the treasury, the attacker’s address did not choose a complicated coin mixing path, but rather, within a 13-day window, gradually pushed the chips to the secondary market through multiple on-chain transactions. According to public materials, the relevant address continuously replenished BONK to multiple centralized exchanges, selling each batch immediately after it was listed, forming a complete financial chain of "governance proposal – treasury transfer – batch listing and selling on CEX." Throughout the process, it was clear on-chain that the tokens concentrated from a single treasury address into the attacker's address, and then from that address, they were sold in batches to different exchanges, with the reverse path almost all withdrawing in fiat or other asset forms from the visible on-chain system.
In terms of financial results, this governance attack ultimately realized a cash-out scale of approximately $13.58 million, all corresponding to the 4.426 trillion BONK withdrawn from the treasury. At the final point of this sequence, on July 20, 2026, the attacker’s address transferred approximately 400 billion BONK to Coinbase, estimated at about $1.17 million at the time, which took place about 30 minutes before the report and was regarded as the hallmark transaction of fully clearing the position by on-chain analyst Yu Jin. After completing this sale, the address no longer held any BONK from the Bonk treasury, indicating that the process of leveraging the treasury through an upfront investment of around $4.4 million and then cashing out $13.58 million through batch selling reached a conclusion on-chain, while Bonk's treasury suffered a quantifiable direct asset loss in the millions of dollars during this round of governance attack.
Concentration of voting power risk exposure: How flimsy is the DAO defense
In this Bonk treasury governance attack, analysis from a single source suggested that approximately $4.4 million worth of BONK was sufficient to control important governance proposals related to the treasury, directly leveraging around 4.426 trillion BONK for transfer. At the governance level, the commonly used DAO design of "distributing voting rights according to the number of tokens held" inherently amplifies the influence of single entities when tokens are concentrated in a few addresses in the short term. If critical proposals regarding the treasury, parameter adjustments, etc., lack higher thresholds or additional constraints, a few addresses can dominate the outcome in a very short period.
The industry has long discussed potential attack paths using flash loans, short-term financing, or concentrating on acquiring tokens within the voting window to manipulate governance. This incident provided practical validation of this systemic risk. Although it hasn’t been disclosed whether the attacker used external financing, on-chain confirmation shows that the closed loop of buying BONK upfront to gain voting rights, followed by proposing the massive token outflow from the treasury and completing cash-out has already been established. This means that under similar voting rules, as long as the funding volume reaches the set threshold, governance votes could shift from "distributed consensus" to "short-term capital voting," making Bonk a clear and quantifiable case of such voting power concentration risk.
Pressure on BONK price and market sentiment: What can on-chain signals say?
According to a single source, in recent days, the attacker’s address has been transferring and selling the BONK obtained from the treasury to multiple centralized exchanges in batches, which has been viewed by many discussants as one of the significant factors weakening the BONK price. However, from an on-chain perspective, what can be confirmed is only the passage of the governance proposal, the treasury's transfer of approximately 4.426 trillion BONK to the attacker’s address, and the subsequent multiple transfers and sales. Existing public materials did not provide specific price ranges, percentage declines, or trading volume as quantitative indicators before and after the event, nor did they support data on funding rates, position structures, or liquidation scales. Therefore, the relationship between the attacker’s selling and the price pressure can currently only be regarded as a "highly correlated" market view, rather than a causality verified by data. Readers should deliberately distinguish verifiable on-chain actions from unquantified market judgments when interpreting such claims.
On July 20, 2026, the attacker’s address transferred the final 400 billion BONK (approximately $1.17 million) to Coinbase. Subsequently, analysts monitored that the address no longer held any BONK from the Bonk treasury. This liquidation node also became a new dividing line in sentiment discussions: on one hand, the “certainty sell pressure” phase from the same address came to a close; on the other hand, concerns surrounding governance attacks and treasury security began to replace the narrative of single selling pressure, becoming the main axis of community and market discussions. At present, no specific response measures at the exchange level have been publicly disclosed, and it remains to be seen whether the project team will propose governance remedies or treasury reconstruction plans. In the absence of more complete quantitative market and institutional response information, any judgment about whether BONK price remains under pressure can only be cautiously limited to material and sentiment levels, and cannot be regarded as a conclusion that has been jointly verified by on-chain and market data.
From Bonk to the whole market: Warnings and tracking after the governance attack
From the on-chain life cycle perspective, this incident has almost demonstrated the governance attack process surrounding project treasury: About 13 days ago, the attacker concentrated investment of about $4.4 million to buy BONK to gain sufficient voting rights; then they controlled and passed governance proposals related to the treasury, leading to approximately 4.426 trillion BONK transferring to their address; subsequently, over the next few days, the tokens were transferred to multiple exchanges in batches and sold, ultimately transferring the last approximately 400 billion BONK (about $1.17 million) to Coinbase on July 20, 2026, and completing liquidation, with on-chain analysis showing a cumulative cash-out scale of around $13.58 million. This on-chain closed loop directly exposed the vulnerabilities in DAO governance: the design of “holding tokens equates to voting” is sufficient to enable a single address to influence significant treasury-related decisions in a short time when the voting threshold is not secure enough and power can be concentrated through buying. The treasury management and proposal review mechanisms have clearly failed to block "malicious proposals in legal forms." On a broader market dimension, the case of Bonk’s treasury being emptied has become a critical risk reference point that cannot be ignored when evaluating other project governance parameters, rather than a one-time black swan. What deserves close tracking going forward is whether Bonk will adjust its voting rules on-chain, raise the passage thresholds for treasury-related proposals, introduce stricter treasury protection arrangements, and whether other DAO projects will proactively review their governance designs. If on-chain modifications to voting rules, multi-signature initiatives for the treasury, structural upgrades of permissions, or increased governance participation emerge in the future, these will serve as key signals for assessing the effectiveness of responses to such governance risks. Readers should also view similar governance anomalies surrounding the treasury as long-term structural risks within the entire token governance system and continue to track relevant on-chain movements.
Join our community to discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
