BONK faces $20 million treasury drain after attacker spends $4 million to pass malicious proposal

Onchain governance was heralded a few years ago as the future of how communities run themselves. But a multimillion attack on the memecoin BONK shows the cost of putting a treasury at the mercy of a public vote anyone can buy their way into.

BONK DAO was drained of $20 million late Monday, the culmination of a week-long scheme in which an opportunistic attacker spent about $4.4 million buying up the project's bonk tokens to force through a vote. Every step was a legitimate transaction — such as the buying, the vote, the payout — and together they carried out a theft.

BONK is a Solana-based memecoin, and BONK DAO is the decentralized autonomous organization that governs it, a structure where token holders vote on proposals rather than a company making decisions. Anyone holding enough tokens can propose a change and, if a vote passes, have it execute automatically onchain.

That design was the specific weapon used in this attack.