Key highlights:
- BonkDAO lost $20 million through a governance exploit
- An attacker spent about $4.4 million buying tokens to gain enough voting power
- BONK dropped around 8% as the stolen funds began moving toward exchanges
The Solana-based memecoin
The final result was quite close. The proposal got support equal to 882.38 billion tokens. This is just above the required quorum of 879.95 billion. Once approved, the system automatically transferred 4.426 trillion BONK tokens, which were valued at $20 million, from the treasury to the attacker’s wallet.
Selling pressure sends the token lower
The token reacted almost immediately after the news became public. Data shows that some of the stolen tokens were moved to exchanges right after the attack. $188,000 was moved to an exchange, while most of the remaining funds were transferred into a multisignature wallet.
Source: Lookonchain
The attacker also started selling the tokens they got to gain voting power, which was worth around $5.3 million. BONK had dropped more than 8% as of press time, erasing part of the rally it had enjoyed only days earlier. Right before the exploit, the token had rallied about 14% in just a day.
In the meantime, BonkDAO shared that it is working with exchanges, blockchain bridges, the Solana Foundation, security researchers, and law enforcement agencies to track and possibly get back the stolen funds.
“Law enforcement has been notified. BonkDAO continues to work with relevant parties to recover funds and identify those responsible,” they wrote.
Another warning for the crypto industry
The new incident comes during a year that has continued to see a surge in crypto-related security breaches. Industry reports show us that 83 crypto exploits happened during the second quarter of 2026 alone, making Q2 the busiest quarter on record for hacking incidents.
Meanwhile, blockchain security firm CertiK reported $1.3 billion in losses across 344 Web3 security incidents during the first half of the year.
Some security experts have come out to say that the reason why this happened is that BonkDAO does not employ protections commonly used by large DAOs. For example, execution delays that allow communities to review approved proposals before they take effect.
Also, the DAO apparently does not have an emergency override mechanism that can stop suspicious transactions. Without these, the attacker was able to move from proposal approval to treasury transfer with no issues.
Source:: BonkDAO Just Lost $20M Without Being Hacked, BONK Slides 8%