What happened
On July 6, 2026, an attacker drained about 4.43 trillion BONK (roughly $19-20 million) from the BonkDAO treasury on Solana by passing a governance proposal, BIP #76 "Sowellian BonkDAO", that was framed as a reform but transferred the treasury to an attacker-controlled wallet. The attacker spent about $4.4 million buying BONK on centralized exchanges to clear the 1% quorum in a vote with about 2.9% turnout. Because the proposal had no execution delay, the treasury moved as soon as the vote passed.
Most of the funds were then moved to a multisig, and no recovery had been reported at the time of the rekt.news write-up. BonkDAO called it a malicious governance proposal and said it was working with exchanges, bridges and the Solana Foundation.
How it happened
- The attacker created proposal BIP #76, titled "Sowellian BonkDAO", on the DAO's Realms governance page; its description obscured that its instruction transferred the whole treasury to a wallet the attacker controlled.
- In the days before voting, the attacker bought about $4.4 million of BONK on Bybit and Binance, gathering just over the quorum of 1% of supply (the quorum threshold was about 879.95 billion BONK).
- On July 6, 2026, the attacker's wallets voted yes. With about 2.9% turnout and almost no opposing votes, the proposal passed with roughly 99.9% support.
- The proposal's instruction hold-up time was zero seconds, so the treasury transfer of about 4.43 trillion BONK could execute immediately, leaving no window for the community to react.
- The attacker moved most of the BONK to a multisig wallet within hours and sent a smaller amount to an exchange.
Protocol details
Evidence
- report BONK official incident statement x.com
- report @AMLBotHQ incident report x.com
- report @PeckShieldAlert incident report x.com
- report @CertiKAlert incident report x.com
- report BonkDAO - Rekt rekt.news
- analysis DeFiLlama defillama.com
- analysis BonkDAO loses $20 million following malicious governance proposal attack theblock.co
- analysis BONK faces $20 million treasury drain after attacker spends $4 million to pass malicious proposal coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
