There was no exploit code. There is no private key at risk. No phishing link. However, BonkDAO says attackers stole about $20 million from BONK through a malicious governance proposal targeting its Solana treasury.
The attacker didn’t break the rules, he bought them.
What happened to Punk Dow?
$BONK is a memecoin built on Solana, and BONK DAO is the community body that governs it. Token holders vote on the proposals, and if a vote is cast, it is automatically executed on-chain. This design is exactly what was armed.
The sequence began on June 30, when an anonymous wallet submitted a proposal to transfer Treasury holdings to a wallet it controlled. This proposal was titled “BIP #76 – Sowellian BonkDAO,” and was more like a pitch than a rip-off: it sought to “implement Sowellian rule, install new members and council, rebuild from the ashes, monetize property, and stop the bleeding,” and attached a reward promising all “yes” voters that they would be eligible for BONK tokens.
Buried beneath the marketing language is the only line that matters — instructions to transfer approximately 4.4 trillion BONK directly to the attacker’s wallet.
How did the attacker pass a fake offer?
This is the part that should keep every DAO up at night. The proposal needs “yes” votes equal to 1% of the BONK bid to reach a quorum. So the attacker simply went and bought it. Over the course of July 4 and 5, a separate wallet took in exactly that amount, spending around $4.4 million to buy BONK on the platform. Exchanges PayBit and Binance.
By the time voting closed, the numbers were nearly accurate. The motion was approved by a vote of just seven governors, compared to more than 18,000 members who did not – a turnout of 2.9%. The quorum was completed by the narrowest margin, 882.38 billion BONK in its favor against a threshold of 879.95 billion, which is almost exactly the stake that the attacker spent days amassing.
The result? The 99.9% yes vote was one voter’s approval. The DAO then did what it was created to do, automatically executed the transfer, and about $20 million worth of BONK was moved from the vault to the attacker’s wallet.
Bonk DAO Attack: Where did the money go?
Stolen Symbols It didn’t stick. More than 4.4 trillion BONK — worth approximately $19.3 million at the time of transfer — were transferred from the treasury to an address ending in “JHvQ,” which was identified via Solscan as having been funded through a Bybit account. By 3:30 PM ET that same day, the tokens were moved again, this time to a different Solana address ending with “eh42.”
The promised voter bonuses never materialized. The tokens were never distributed, and were instead moved to a second address hours later, a pattern consistent with an attacker trying to cover the trail rather than honor any community commitment. Security firm PeckShield later indicated that approximately $148,000 in stolen BONK had already moved to OKX.
Has Bonk DAO been hacked?
Technically, no, and that’s the uncomfortable part. The attacker did not exploit a bug in any smart contract. The main problem was the management design, not the code. Each step was a valid, authorized transaction across the chain.
With no time lock, minimum quorum, or multi-signature check to catch an anomalous proposal before it is executed, a well-funded attacker was able to turn a $4 million token purchase into control of a $20 million treasury. A time lock would have created a delay between approval and implementation, giving the community an opportunity to monitor attrition. It is possible that bypassing the multisig will cause it to freeze in an emergency. BONK DAO had neither.
This has reopened an old debate. Because each step was a valid transaction, some on-chain observers argued that the attacker simply exploited a weak governance design rather than breaking into it. And the lesson goes both ways: a treasury that can be drained by anyone who assembles a temporary voting majority is only as safe as it costs to buy that majority—and here, that cost was a small fraction of the prize.
WHAT DOES BONK DAO DO ABOUT IT?
BonkDAO has notified law enforcement and is working with the Solana Foundation, central exchanges and network bridges to recover the funds. It said it identified the exchange wallets used to purchase tokens before the vote — and the involvement of law enforcement makes clear that the DAO is treating this as an attack, not a clever vulnerability.
But recovery is an uphill battle. Governance-related attacks are notoriously difficult to counter, precisely because they occur through the protocol’s legitimate mechanism.
How did the BONK price react?
The market response was surprisingly contained given the volume. BONK prices fell by about 7% over the past 24 hours in the wake of the attack. Exchanges moved quickly – South Korea’s Upbit exchange and US Kraken exchange temporarily halted deposits and withdrawals of the BONK token, with Upbit citing “user protection measures following the circumstances of a security incident.”
