The incident highlights a critical vulnerability in decentralized governance structures, as the attacker did not exploit smart contract code, but rather subverted the protocol’s voting mechanism. By accumulating significant voting power, the perpetrator successfully pushed through a malicious proposal that transferred roughly 4.426 trillion $BONK tokens from the DAO treasury to a wallet under their control.
Attacker Exploits Governance Loophole
In a statement posted to X, BonkDAO outlined the nature of the breach: “BonkDAO was the target of a malicious governance proposal resulting in an estimated $20M worth of $BONK tokens being drained from the BonkDAO treasury. During the investigation, BonkDAO identified the exchange wallets used to purchase $BONK ahead of the proposal. BonkDAO is currently actively working with exchanges, bridges and Solana Foundation to best manage the situation.”
Unlike traditional decentralized finance ( DeFi) hacks that rely on reentrancy or oracle manipulation, this event serves as a stark reminder of the risks inherent in token-weighted voting systems. The attacker reportedly utilized open-market purchases to gain the necessary weight to force the proposal through the Realms governance platform, effectively capturing the treasury’s authority.
news.bitcoin.com