Someone Stole $21M From BonkDAO Without Hacking Anything

An attacker has stolen $21.2 million from the BonkDAO treasury without hacking anything. They purchased BONK tokens for $4.4 million, submitted a governance proposal that went unchecked for seven days, voted yes with their own tokens, and watched the funds automatically move to their wallet. Once executed, the transfer was irreversible.

In a few hours, BONK price dropped approximately 6.59%, with 955.47 billion volume. The token fell from a high near 0.00000490 to 0.00000417 as the news spread. Market cap lost approximately $40 million, and some exchanges halted BONK withdrawals.

The proposed project, BIP #76 (Sowellian BonkDAO), discussed governance improvements, asset monetization, and token rebuilding without concrete details. The transaction moved 4.426 trillion BONK tokens to the attacker’s wallet.

The attacker bought 882.285 billion BONK tokens—enough to meet the quorum threshold. Their entire stack was used to vote. When the voting period ended, trillions of BONK tokens poured into their wallet as the proposal passed. Seven days passed with too few community members reading or voting against it. No technical flaw occurred; simply nobody was listening.

BONK was launched on Christmas Day 2022, shortly after FTX’s collapse, based on community ownership with no VC investment or insider allocation. BonkDAO has identified the attacker’s wallets, notified exchanges, bridges, the Solana Foundation, and law enforcement. Recovery efforts are ongoing, but the on-chain automated transfer makes retrieval difficult. The attacker turned $4.4 million into $21.2 million—a 5x return via the project’s own democratic process.

This incident highlights a fundamental DAO governance flaw: if most token holders do not vote, a treasury is like an unlocked door. No quorum was obtained at BIP #76, so $4.4 million in bought votes sufficed. The same attack is possible anywhere the quorum is low enough.

Source: https://coingape.com/someone-stole-21m-from-bonkdao-without-hacking-anything/