DeFi Governance Attack Cluster 2026 (BonkDAO + Term Labs Pattern)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·iGbXfu…bw2iSummary
Between June and August 2026, at least four DeFi protocols — Token of Power, BonkDAO, BarnBridge SMART Yield, and Term Labs — lost a combined minimum of roughly $31 million to a recurring attack pattern in which an attacker cheaply acquires enough token-weighted voting power to pass a self-serving proposal through a protocol's own governance system, without exploiting any smart contract bug. This is a thematic cluster covering a genuine, verifiable attack class rather than a single entity; individual protocols in the cluster vary in size and legitimacy, but the pattern itself — low quorum thresholds, low voter turnout, and liquid governance tokens combined with governance-controlled treasuries — is a real, recurring structural vulnerability documented by multiple independent security firms and news outlets. A widely repeated claim that DefiLlama counts exactly "five governance attacks totaling $25.1 million" in 2026 could not be independently verified and appears mathematically inconsistent with the incidents this investigation confirmed, which alone exceed that total.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(8 events)
June 2026
Attacker cheaply acquires majority of Token of Power's tiny fixed token supply and mints 10 billion new TOP tokens via a single-transaction Aragon governance proposal with no timelock, draining roughly $1.58-1.59 million in WETH via a Balancer pool.
Blockaid / Bitcoinist (TRM Labs)June 2026
An anonymous wallet submits BonkDAO proposal 'BIP #76 – Sowellian BonkDAO,' which contains a hidden clause transferring roughly 4.4 trillion BONK from the treasury to the proposer's wallet.
CoinDesk6 July 2026
BonkDAO proposal passes with 99.9% yes votes from 7 wallets (2.9% turnout); roughly $20 million in BONK is drained from the treasury.
crypto.newsJuly 2026
BonkDAO confirms the attack publicly and says it is coordinating with exchanges, bridges, and the Solana Foundation to manage the fallout; CoinDesk and other outlets report the incident.
CoinDeskJuly 2026
BarnBridge SMART Yield governance is hijacked via a cheaply-acquired voting position, replacing a controller contract and sweeping roughly $776,000-$777,000 in stale USDC approvals from about 50 wallets.
GoPlus Security / KuCoin23 August 2026
Term Labs' Meta Vaults are drained of roughly 2,843 ETH and 1.68 million USDC (approximately $8.5 million total) after an attacker accumulates governance voting power over the vaults' wrapper token and disables the transaction delay; PeckShield and CertiK confirm the incident.
The BlockAugust 2026
Term Labs reports it has moved the final affected fixed-rate loan position back to safety, completing recovery of loan positions (though the roughly $8.5 million in drained liquid vault balances remains lost).
crypto.newsSeptember 2026
Term Labs publishes a fuller incident report; industry outlets (crypto.news, Cryptonomist, Blockaid) begin framing BonkDAO, Term Labs, Token of Power, and BarnBridge as a connected 2026 'governance attack' wave.
CryptonomistDecision Log
- hash: 9a11JwnFgFjaV9NjUCWxnALHfPHGPavafLu3iQvtG5R
This investigation is cryptographically anchored to the Solana blockchain (1 event). 15 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 9/25/2026, 12:10:30 PM
last updated: 9/25/2026, 4:54:48 PM
avoid.net — verified advice for a post-truth world