BONK DAO Proposal Cleared A 1% Quorum

CoinDesk reported that a BONK DAO governance attack turned a temporary token position into control of a memecoin treasury: the attacker spent roughly $4.4 million to buy just over 1 percent of BONK's supply and pushed through a proposal that drained about $20 million in BONK tokens.

The Solana-based DAO's onchain system then executed the transfer automatically after the vote passed.

The case is a governance failure rather than a conventional private-key breach in the public account of the incident.

CoinDesk described BONK as a Solana-based memecoin and BONK DAO as the decentralised autonomous organisation that governs it, where token holders vote on proposals that can execute onchain if they pass.

June 30 Proposal Sent Treasury Tokens To The Attacker

CoinDesk cited Chainalysis in tracing the first step to June 30: an anonymous wallet put forward a proposal that would move the treasury holdings into a wallet under its control.

CoinDesk reported that the ballot needed yes votes equal to 1 percent of BONK's supply to meet quorum.

According to CoinDesk, a separate wallet acquired that voting power over July 4 and 5 by spending about $4.4 million to buy BONK on Bybit and Binance.

CoinDesk said Lookonchain also described borrowing through DeFi lending platforms.

Seven Wallets Voted While 18,000 Members Did Not

The proposal, titled "BIP #76 - Sowellian BonkDAO," passed with just seven wallets voting, while more than 18,000 members did not vote, CoinDesk reported.

CoinDesk reported turnout of 2.9 percent and a result showing 99.9 percent yes votes.

CoinDesk reported that the vote cleared quorum by a narrow margin, with 882.38 billion BONK in favour against an 879.95 billion threshold.

CoinDesk reported that the written proposal included a transfer instruction for 4.43 trillion BONK to the attacker's wallet.

Chainalysis Traced Transfers After The Drain

CoinDesk reported that by July 6, the voter had enough tokens to pass the measure.

CoinDesk reported that after the vote, about $20 million in BONK moved automatically from the treasury into the attacker's wallet.

CoinDesk, citing Chainalysis, said roughly $188,000 was sent to an exchange about nine hours later, while the remaining $19 million was moved to a multisig wallet.

CoinDesk also reported that the attacker later sold about $5.3 million of the BONK acquired for the vote while retaining the treasury tokens.

BONK DAO Has Not Published Recovery Terms

BONK DAO confirmed what it called a malicious governance proposal and said it had identified exchange wallets used to buy tokens before the vote.

According to CoinDesk, the DAO said its response involved exchanges, bridges and the Solana Foundation.

CoinDesk and BONK DAO did not identify final law-enforcement outcomes, frozen exchange balances, a recovery timetable, reimbursement terms for the DAO treasury, or governance-rule changes that would stop another temporary voting majority from passing a similar treasury transfer.