BONK's $20M Lesson: When "Following the Rules" Is the Attack

The proposal was called BIP #76, and it was introduced as a set of changes to the DAO governance: new leadership, treasury monetization, restructuring. But there was one sentence in the proposal that really matters: transfer 4.43 trillion BONK to the address controlled by the proposer. The whole process took six days while the attacker quietly gathered just above 1% of the BONK circulating supply. Although that sounds like a lot, it was just enough to gather quorum and not more. In total, seven crypto wallets voted for this proposal when the voting ended on July 6. About 18,000 DAO members did not vote at all. Voting participation rate – 2.9%; approval – 99.9%.

The BonkDAO’s proposals get executed right away after they pass without timelock, council, or any “pause” functionality. Therefore, the moment the vote exceeded the quorum requirement, the treasury was drained. No permission needed since none was required. The vulnerability was in the quorum requirement itself: fixed at a 1% threshold of supply, it did not take into account the fact that participation rate might slowly decrease to single digits while the treasury grows to hundreds of millions.

Though the attack is shocking enough, it is far from being an innovation. Vote-buying infrastructure like bribe markets, delegation sites, and notorious “rent-a-vote” tools have been running in the open for years now and are considered a regular incentive mechanism in DeFi governance. The BonkDAO attacker did not invent anything new; they only turned an already existing machine towards the treasury rather than emissions control. Unlike infamous 2022 Beanstalk flash-loan attack, this one uses real capital held for days, which renders any countermeasures for governance attacks ineffective.

It’s called the “cost of corruption” by security researchers: how much it takes to purchase enough voting power compared to what there is available in the treasury that will be under control after the win. The healthier the system, the bigger the difference between the two figures. The ratio of BonkDAO was $4.4 million against $20 million, a 4x investment that remained undetected in a public governance forum for about one week. Every DAO not having this figure calculated can only assume that somebody else did.

The response divided right away. While some insist that no rules were broken, as the winner did win a legitimate vote and executed it correctly, calling this case a “hack” whitewashes the DAO’s own mistake. Others – including BonkDAO itself and even David Schwartz of Ripple – stand behind the fact that a proposition made in a deceptive way and designed to keep people from voting is still fraudulent despite perfect execution of the code. That’s what the courts have always been using for decades in regard to shareholder votes.

Fallout didn’t take long following the news, as BONK dropped 8–10% before stabilizing. Upbit froze BONK deposits and withdrawals. BonkDAO claims that the wallets from the exchanges utilized for building up the position held by the attacker (one apparently funded via Bybit) have been identified, and they have brought in law enforcement, the exchanges, the bridges, and the Solana Foundation on board. No user wallets were involved, and the contract behind the BONK token was not affected. Only the treasury, which paid for all the grants, buybacks, and initiatives was hit. Given how memecoins are all about community coordination, one may say that in this instance, having the coordination fund emptied out through the coordination process was especially ironic.

One may expect that users will be facing a flood of DAOs trying to patch up things that BonkDAO lacked, such as timelocks on treasury-moving proposals, multisig emergency vetoes, quorums tied to the amount of treasury rather than a fixed percentage set long ago, and mandatory periods for reviewing the proposal before its implementation. None of this is new or innovative. It is just what BonkDAO lacked, and now there is a $20 million example of what may happen.

The cost of quietly assembling a winning vote is that every DAO treasury has a market price now. If that number is smaller than the treasury itself, the treasury isn’t really owned by its community. Instead, it’s rented out to whoever’s willing to pay the quorum. BonkDAO found out what its rent was on a Monday in July. Everyone else gets to check theirs before they have to.