Incident Overview
In 6th July 2026, the Solana-based dog-themed memecoin protocol Bonk Inu (BonkDAO) fell victim to a malicious governance takeover exploit on the Solana network, resulting in the treasury being drained of 4.426 trillion BONK tokens, valued at approximately $21 million.
The exploit was an economic governance attack that completely bypassed traditional smart contract vulnerabilities by operating strictly within the legitimate, on-chain rules defined by the protocol's Solana Realms governance portal. The attacker capitalized on chronically low voter turnout and a flawed quorum threshold structure.
The attacker initially acquired approximately $4.4 million worth of BONK tokens on the open market using funds routed from central exchanges. This substantial position allowed the attacker to single-handedly cross the DAO's 1% quorum threshold needed to introduce and pass active network referendums. The attacker then submitted a malicious proposal to transfer the entire BonkDAO treasury balance to an external wallet. Out of more than 18,000 potential community voters, only 7 legitimate wallets participated in the active voting window. The attacker cast a massive "yes" vote alone, overwhelming the voter pool, legally passing the proposal, and automatically triggering the on-chain transfer of 4.426 trillion BONK tokens. The team quickly alerted the Solana Foundation and various centralized exchanges to flag and freeze the attacker's primary holding address.
Attacker Target Wallet: 9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ
Attacker Holding Wallet: EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to BonkDAO, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next BonkDAO
The BonkDAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.