Anonymous Wallet Drains $21 Million from BonkDAO Treasury in Governance Vote
An anonymous cryptocurrency wallet has successfully drained $21.2 million from the BonkDAO treasury by strategically acquiring BONK tokens and leveraging them to pass a governance proposal. The incident, which saw the attacker profit $16.8 million, has ignited a debate within the crypto community, dividing opinions between those who label it a theft and those who argue the Decentralized Autonomous Organization (DAO) functioned as intended.
The Mechanics of the “Theft”
Blockchain analytics firm Lookonchain reported that the operation began on June 30 when the attacker submitted a proposal to BonkDAO requesting the transfer of 4.426 trillion BONK tokens, valued at approximately $21.2 million, to a wallet under their control. For the proposal to pass, it required the support of at least 1% of the total BONK supply, which, according to CoinGecko data, stands at just under 88 trillion tokens.
Beginning around July 4, the attacker proceeded to purchase 882.285 billion BONK tokens on the Bybit and Binance exchanges. This amount was precisely enough to meet the 1% quorum requirement (879.95 billion tokens) needed to vote on their previously submitted proposal. Subsequently, the attacker cast a “yes” vote with their entire holdings of 882.285 billion BONK, thereby passing the proposal and enabling the transfer of the 4.426 trillion tokens to their controlled wallet.
Chainalysis, another firm tracking on-chain activity, corroborated Lookonchain’s findings. The firm stated that the attacker acquired their tokens between July 4 and 5, sourcing some from major exchanges and borrowing others through decentralized finance (DeFi) platforms.
Aftermath and BonkDAO’s Response
Approximately nine hours after securing the $21 million in tokens, the attacker transferred $188,000 to OKX, a figure Peckshield places at $148,000. The remaining funds were then deposited into a newly created DAO, dubbed “BONK 2.0,” which the attacker established to govern the stolen assets. Chainalysis indicated that this new DAO is controlled by the malicious voter, the exploiter wallet, and a third wallet with reported financial ties to the voter wallet.
BonkDAO acknowledged the treasury loss in a statement released on X. The DAO confirmed it had identified the exchange wallets used to acquire the voting tokens prior to the proposal’s success. It also stated that law enforcement had been notified and that the DAO was coordinating with exchanges, bridges, and the Solana Foundation to “manage the situation.”
Following the news of the incident, the BONK token experienced a decline in value. At the time of writing, CoinGecko data showed BONK trading around $0.00000438, representing a 7.4% drop in 24 hours, though it remained up nearly 5% for the week.
This event contributes to a broader trend of DeFi platforms losing close to $1 billion to malicious actors this year, as reported by CryptoRank.
Divergent Views on the Incident
However, not all observers agree that a crime has occurred. Ogle, an advisor at World Liberty Financial, questioned the involvement of law enforcement, characterizing the event as a standard DAO function. “Someone legitimately bought a lot of tokens, proposed a DAO vote, the vote passed with almost no opposition, and the proposal was executed,” Ogle wrote on X. They further suggested that reports of the voting website being inaccessible during the voting period, if true, would raise separate concerns but did not necessarily render the on-chain vote illegal.
Conversely, others, such as Ripple CTO Emeritus David Schwartz, argued that using governance control over a shared treasury for personal gain could constitute fraud, citing a fiduciary duty owed by governance participants to other stakeholders. Schwartz also noted that BonkDAO’s lack of a formal legal structure could expose participants to partnership-style liabilities in certain jurisdictions.
Leave a Reply