BonkDAO Treasury Governance Attack (July 2026)
Summary
On July 6, 2026, an unidentified attacker drained approximately $20 million in BONK tokens from BonkDAO's treasury on Solana's Realms governance platform by spending roughly $4.4 million to acquire just over 1% of BONK's circulating supply, meeting the DAO's quorum threshold and passing Bonk Improvement Proposal #76 with 99.9% approval across only seven voting wallets — a turnout of 2.9%. The attack exploited three compounding structural design failures — a permissively low quorum floor, no execution timelock, and no multisig safeguard — rather than any smart contract code vulnerability, and is widely characterized as the most significant governance-attack-as-exploit in Solana DAO history.
Connected Entities
2 entities · 10 linked investigations- EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42→mentioned with→BonkDAO Treasury Governance Attack (July 2026)(50%)
Timeline(5 events)
2026-06-30
Anonymous wallet submitted Bonk Improvement Proposal #76 (BIP-76 – Sowellian BonkDAO) to BonkDAO's governance system on Realms. The proposal was framed as organizational restructuring but contained a hidden instruction to transfer 4.43 trillion BONK to an attacker-controlled wallet.
CryptoTicker / crypto.news2026-07-04
Attacker began accumulating BONK tokens through purchases on Bybit and Binance and reportedly via a $4 million loan from the MarginFi protocol, spreading purchases across multiple wallets over two days to avoid detection.
CoinDesk / Phemex2026-07-05
Attacker completed token acquisition, holding approximately 882.38 billion BONK — just above the 879.95 billion quorum threshold representing 1% of circulating supply. Total acquisition cost approximately $4.4 million.
CryptoTicker2026-07-06
BIP-76 passed with 99.9% of votes cast (seven wallets in favor, 18,000+ holders abstaining, 2.9% total turnout). Attacker-linked wallets controlled approximately 99.878% of votes. Realms executed the treasury transfer automatically, moving 4.43 trillion BONK (approximately $19.3-$21 million) to attacker wallet ending in JHvQ. By 3:30 p.m. ET, funds moved to secondary address EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42 (ending in eh42). Approximately $148,000-$188,000 transferred to OKX; approximately $5.3 million reportedly sold.
CryptoTicker / Solana Floor / CoinDesk2026-07-07
BonkDAO publicly confirmed the attack. BONK price fell 7%-10% in the following 24 hours. Exchanges Upbit and Kraken suspended BONK deposits and withdrawals. BonkDAO announced coordination with the Solana Foundation, exchanges, bridge operators, and law enforcement. On-chain analyst Specter published preliminary attribution findings linking attacker wallets to the Realms platform founder and crypto_notte via shared exchange deposit addresses, explicitly caveated as incomplete and non-conclusive.
CoinDesk / CryptoAdventure / DecryptDecision Log
- #1publish⛓ pending8/2/2026, 5:17:55 PMhash: 4fhcDqF1KPe9fEs8NYMrkyRngk13oANWSSbdnZbuUAJf
11 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 5:17:42 PM
last updated: 8/2/2026, 7:33:29 PM
avoid.net — verified advice for a post-truth world