There is no need to break into the vault when the governing council itself can be persuaded to open the door. That is what happened to BONK DAO, the governance body behind the popular Solana meme token BONK - resulting in around Rp326 billion vanishing in a matter of days through a method that was, technically, entirely “legitimate.”
Rp71.7 Billion to Control the Vote
The scheme began on June 30, when a proposal was quietly submitted to BONK DAO’s on-chain governance system to transfer a portion of treasury funds to a new wallet. Between July 4-5, the proposer bought around Rp71.7 billion worth of BONK tokens through Binance and Bybit exchanges - just enough to control 1% of the total token supply, which is the minimum quorum threshold for a proposal to be considered valid for execution.
On July 6, the entire holding was used to vote “yes” on the proposal. The result was nearly unanimous: 99.9% in favor. The issue was that only 7 wallets out of more than 18,000 DAO members participated in the vote - a participation rate of just 2.9%. With turnout that low, a single major buyer was enough to become the sole deciding factor. The proposal passed with 882.38 billion BONK in favor, narrowly crossing the 879.95 billion threshold, and was automatically executed by the smart contract - funneling treasury funds directly to the attacker’s wallet without requiring any additional human approval.
Rp309.7 Billion Still Idle, Portion Already Cashed Out
Of the total looted funds, around Rp3 billion was sent to an exchange within 9 hours of execution - likely an attempt to cash out part of the stolen proceeds. The remaining Rp309.7 billion was moved to a multisig wallet requiring multiple signatures for withdrawal, where it currently sits untouched. The attacker has also reportedly sold about Rp86.4 billion worth of the BONK tokens originally acquired to win the vote. BONK’s price plunged 7% within 24 hours after the incident was uncovered.
The BONK DAO team confirmed the attack and stated that they are coordinating with exchanges, cross-chain bridges, and the Solana Foundation to track and attempt to recover the lost funds.
When On-Chain Democracy Becomes a Vulnerability
This case reignites a longstanding debate in the crypto world: does legitimately buying voting power and using it to drain a treasury count as theft, or simply exploiting flawed rules from the start? What is clear is that this incident serves as a bitter reminder that token-based governance systems - regardless of strong “decentralization” narratives - remain vulnerable to being hijacked by anyone with enough capital and knowledge of the loopholes, especially when actual token holder participation is extremely low.
Reported by CoinDesk.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
