Lookonchain
An attacker spent roughly $4.4M to drain about $21.2M from the BONK memecoin treasury on June 30, pocketing a $16.8M profit after a textbook quorum-based governance attack.
How the attack worked
The attacker submitted a governance proposal to transfer 4.426T $BONK from the project treasury to a wallet he controlled. Over the previous two days, he accumulated 882.285B $BONK across Bybit and Binance at a cost of $4.4M, enough to clear the 879.95B $BONK quorum threshold for the vote. He voted "Yes" with the full stack, the proposal passed, and the treasury transfer executed automatically to his address.
Why it matters
The exploit exposes how thin governance becomes when the cost of clearing quorum is a fraction of the treasury it controls. For BONK, a memecoin with no protocol revenue to absorb the loss, the $21.2M hole is roughly a third of typical DAO treasuries its size. Other Solana memecoin DAOs using Realms-style governance will now have to re-price the quorum-to-treasury ratio their token-weighted voting allows, since the same template is publicly replicable against any project where buying the vote is cheaper than the assets it can move.
Source: [source](https://v2.realms.today/dao/84pGFuy1Y27ApK67ApethaPvexeDWA66zNV8gm38TVeQ/proposal/6wR1jdhhJ31bbdRNXva8MxqsgsNLKTxargcdAyZ7FcRj/votes)
Frequently asked questions
-
How much did the BONK treasury attack cost the attacker?
Roughly $4.4M spent buying 882.285B $BONK on Bybit and Binance to clear the 879.95B quorum threshold. The attacker walked away with about $21.2M, a profit near $16.8M.
-
What exactly did the BONK governance proposal do?
It authorized a transfer of 4.426T $BONK from the BONK treasury to a wallet controlled by the attacker. Once quorum was met and the vote passed, the transfer executed automatically.
-
Which exchanges did the attacker use to buy the voting $BONK?
The attacker accumulated the 882.285B $BONK over two days on Bybit and Binance before casting the vote.
-
Where is the stolen BONK now?
About 40B $BONK (~$188K) has been deposited to OKX. The remaining 4.386T $BONK (~$19.3M) is still sitting in the attacker-controlled wallet.
-
Why is this attack significant for other Solana DAOs?
It shows that when the cost of buying quorum is a fraction of the treasury it can move, token-weighted governance is trivially exploitable. Any Solana memecoin DAO using a similar Realms-style setup now has to re-price its quorum-to-treasury ratio.
WuBlockchain
TheBlock
CoinDesk
CoinTelegraph