BONK Treasury Drained via Malicious Governance Vote in July 2026
An attacker spent roughly $4 million on BONK tokens to meet quorum and pass a malicious governance proposal that drained about $20 million from BonkDAO's
Summary
- An attacker spent roughly $4 million on BONK tokens to meet quorum and pass a malicious governance proposal that drained about $20 million from BonkDAO's treasury on July 7, 2026.
- The BONK DAO hack relied entirely on legitimate onchain governance mechanics with no smart contract exploit involved.
- BONK token price dropped 8 to 10 percent after confirmation of the crypto treasury drain.
An attacker drained roughly $20 million worth of BONK tokens from BonkDAO's treasury on July 7, 2026. He bought enough tokens to meet quorum. Then he passed a governance proposal that sent the funds out. This attack on Solana shows how low-turnout DAO votes stay vulnerable to well-funded takeovers.
No code vulnerability triggered the incident. The attacker simply used the project's existing onchain governance rules. Multiple reports confirm he transferred 4.426 trillion BONK tokens after the vote.
Context
DAO governance security has stayed a persistent concern for meme coin projects. Low participation in proposals often allows large token holders to control outcomes without broad community approval. The July 7 vote exposed these weaknesses at a time when similar raids continue to target treasuries across the sector.
BonkDAO relied on standard onchain voting to manage its treasury. No extra safeguards blocked the proposal once it passed.
Sources including Coindesk documented the sequence. They found no evidence of external hacks or code flaws.
Details
The attacker accumulated BONK tokens at an estimated cost of $4 million. This stake gave him enough voting power to meet quorum and approve the malicious proposal. The vote then triggered an automatic transfer of funds from the treasury.
"Attacker spent
$4M on BONK to gain voting power and passed proposal draining 4.426 trillion BONK ($20M)."
The BONK DAO hack produced an immediate market reaction. Token price fell between 8 and 10 percent once the treasury drain was confirmed. Reports from Phemex and Coinfomania noted the loss totaled approximately $20 million to $21.2 million depending on exact valuation at execution.
No evidence points to any code vulnerability. The attack succeeded through normal governance mechanics alone. This pattern matches warnings issued earlier about meme token DAOs that rely on minimal participation thresholds.
Outlook
Projects are expected to review quorum requirements and proposal safeguards in the weeks ahead. Watch for announcements on updated governance parameters that could raise the bar for future treasury actions.
