The BONK Governance Attack: What DAOs Should Change

By Daniel GelfandPublished November 14, 202610 min read

Quick answer. The BONK governance attack was the July 6, 2026 drain of BonkDAO's Solana treasury. An attacker bought about 1% of BONK for roughly $4.4 million, met quorum on proposal BIP #76, and executed a transfer worth about $20 million instantly.

Watch: The BONK Governance Attack: What DAOs Should Change 1:43

Video transcript

In July 2026, BonkDAO lost about 20 million dollars under its own rules. An attacker bought about one percent of BONK and passed a proposal.

BIP seventy six went live on Realms on June thirtieth. Another wallet bought the voting stake on July fourth and fifth. On July sixth, the vote closed and the transfer executed.

Seven wallets voted, and more than 18,000 members did not. Turnout was about 2.9 percent, and one wallet cast about 99.9 percent of the votes.

Quorum was about one percent of supply, hold-up time was zero seconds, and there was no veto or council override.

Voters read a pitch about rewards for yes voters. The attached instruction sent the treasury's BONK to a wallet the proposer controlled.

The stake cost about 4.4 million dollars and moved about 20 million. The voting wallet began selling about an hour later, per Rekt.

On Realms, check the hold-up time. Zero is a red flag. Compare quorum with turnout, set a council veto, add a cool-off period, decode every instruction and alert on treasury proposals.

As of Blockworks' October 29 report, recovery work was continuing, with no recovered amount or post-mortem public. Upbit and Coinone ended BONK trading on September seventh.

Read the full article for the complete checklist. Guardian Managed Security monitors multisig transactions and large fund movements on every block. Talk to us at guardian.security.

Why It Matters

BonkDAO lost about $20 million on July 6, 2026 when a proposal passed under the DAO's own rules. Decrypt, Halborn, Rekt

That makes it a configuration failure any token-voted DAO can repeat. Low turnout, a low quorum and instant execution are settings delegates can check today.

This breakdown covers BIP #76 on Realms, the parameters that let it pass, and the checks Solana DAOs should run. Generic vectors, including Beanstalk's flash loan, are in DAO governance attacks.

What Happened

BIP #76's text pitched a turnaround and rewards for yes voters. Its executable instruction sent 4,426,104,450,305 BONK from the treasury to a wallet the proposer controlled. Realms, Halborn, Blockworks, Rekt, QuillAudits

Seven wallets voted, and more than 18,000 eligible members did not. crypto.news and Blockworks put turnout at 2.9%. crypto.news

The proposal passed with about 99.9% yes votes, nearly all from one wallet. Execution moved the BONK, valued at about $19.3 million to $21.2 million in contemporaneous reports. Solscan

June 30: an anonymous wallet submits BIP #76, titled Sowellian BonkDAO, to the DAO's Realms governance.
July 4 to 5: a separate wallet buys roughly 1% of BONK supply, about $4.4 million, for voting.
July 6, 09:42 UTC: the vote closes and the treasury transfer executes in the same transaction.
July 6, about an hour later: the voting wallet starts selling BONK.
July 6, nine to ten hours later: about $188,000 goes to an exchange; the rest, to a new three-key BONK 2.0 multisig.
July 6: BonkDAO calls the proposal malicious, notifies law enforcement and starts recovery work. Decrypt

Root Cause: A Cheap Quorum

Reporting describes governance capture, not a token-contract bug or key theft. Token-weighted voting counted the bought stake and executed the instruction as configured. Halborn, crypto.news, Rekt

SPL Governance, the program behind Realms, uses deposited governing tokens as voting weight. A passed instruction runs once its hold-up time has elapsed. Realms, Solana Labs

BonkDAO had set that hold-up to zero seconds. Its quorum was about 1% of supply. Blockworks

The margin shows how precisely the stake was sized. Yes votes totaled 882.38 billion BONK against a quorum of 879.95 billion.

Setting	BonkDAO at the time	What it allowed
Quorum	About 1%, or 879.95 billion BONK	One buyer could meet it alone
Instruction hold-up	0 seconds	Transfer executed as the vote closed
Proposal threshold	100 million BONK	Under 0.02% of quorum to submit a treasury transfer
Veto or council override	None, per Blockworks	Nothing could block the transfer

Why It Worked

Quorum is a share of supply, not of attention. One wallet cast 882.2 billion BONK, per Rekt. Every other vote, yes and no, came to under 1 billion, so a 1% stake was about 99.9% of votes cast. Rekt, crypto.news, QuillAudits

The stake was bought four days after BIP #76 went live and still counted in full. Halborn

The text and the instruction said different things. Blockworks said BIP #76 was presented as a way to reward yes voters but contained a clause moving the treasury. The transfer sat among its listed actions on Realms, per Rekt. Blockworks, Blockworks Intel

Zero hold-up removed the last chance to react. QuillAudits found no delay or veto window between the vote passing and execution.

The attacker did not need to keep the stake either. The voting wallet began selling BONK about an hour after execution, per Rekt.

That is the economic gap. A position of about $4.4 million moved a treasury balance worth about $20 million.

Realms Governance Settings to Check

Realms already exposes the controls BonkDAO went without. Each governance account sets a minimum instruction hold-up time, and a proposal's own hold-up can be longer, never shorter. Realms

Each governance account can permit vetoes by the other voting population. An optional cool-off period after voting accepts only no votes and vetoes. Solana Labs via GitHub

Read the minimum hold-up time (transactions_hold_up_time in SPL Governance code) on every treasury governance account. Zero is a red flag.
Set the hold-up longer than your team needs to spot, decode and escalate a hostile proposal.
Compare quorum with recent turnout, not just supply. A quorum below typical turnout can be met by one buyer.
Price your quorum: estimate what buying it would cost at current market depth, against what the treasury holds.
Set a council veto threshold (council_veto_vote_threshold) so an independent council can veto community proposals.
Turn on a cool-off period so late no votes and vetoes can still land.
Decode every instruction before voting and match its recipient and amount to the proposal text.
Keep reserves outside any account one community vote can spend, and cap outflows per proposal.
Alert on new proposals touching treasury accounts and on large new deposits of governing tokens.

Where It Stands

As of Blockworks' September 8 filing, BonkDAO had published no post-mortem, compensation plan or specific governance patch. Blockworks

That filing said the funds were not recovered, with the bulk in the BONK 2.0 multisig.

BonkDAO's July 13 update said the involved wallets were flagged and monitored. It disclosed no frozen or recovered amount. AiCoin, reproducing BONK official statement

Blockworks' October 29 report said recovery work involving exchanges and bridges was continuing. It gave no recovered amount. Blockworks Intel

An August 12 KuCoin News summary, citing the BONK team, claimed some assets were frozen, the flaw closed, a suspect identified and legal action being prepared. It named no amount, patch or suspect, and we could not verify it. KuCoin News, ME News (MetaEra)

As of November 14, 2026, we found no later public post-mortem, compensation plan or Realms vote changing BonkDAO's quorum, hold-up or veto settings.

Korean exchanges reacted within a day. Coinone suspended BONK deposits and withdrawals from 02:50 KST on July 7, then reopened withdrawals only. Coinone

Upbit flagged BONK with a trading warning on July 7, citing security and disclosure concerns, and suspended deposits. KuCoin, reproducing AiCoin report, Upbit official Telegram channel

Both exchanges ended BONK trading support on September 7, 2026. Coinone cited the unresolved incident and inadequate timely disclosure.

Rekt reported no one charged as of July 10. We found no later public charge or court finding. Rekt

Lessons for DAO Delegates

Treat quorum as a price. If buying it costs less than the treasury it can move, the treasury is for sale.

Treat execution delay as the real defense. An alert only helps if there is a window to act on it.

Read instructions, not descriptions. On Realms, the instructions attached to a passed proposal are what executes. Realms

Plan disclosure as well as recovery. Exchanges weigh what you publish, and when.

Vote weight can also be manufactured in code. Guardian's GMX governance review found transferable tokens could be resynced and minted again, creating infinite voting power (Medium, acknowledged). Guardian

BONK's votes were real, bought tokens. The GMX finding is a different route to the same result: a vote count that no longer reflects the community.

Snapshots, timelocks and emergency roles are covered in our DAO governance security checklist. Reserve tiers and outflow alerts are in our guide to DAO treasury management.

Frequently Asked Questions

Did BONK holders lose tokens from their own wallets?

No. Blockworks noted individual balances were unaffected, and BONK's July 13 update said no user wallets or the token itself were affected. Blockworks, AiCoin, reproducing BONK official statement

Who was behind the BONK governance attack?

No one has been publicly named. Halborn reported the voting BONK was bought on Bybit and Binance. crypto.news said investigators traced the receiving wallet, ending in JHvQ, to funding from a Bybit account. Halborn, crypto.news

Would a higher quorum alone have stopped it?

It would have raised the price, not removed the path. Halborn said Bonk lacked both timelocks and a reasonable quorum threshold. Halborn

Sources

Watch Your DAO Treasury Accounts on Every Block

Guardian Managed Security monitors privileged calls, multisig transactions and large fund movements on every block, with an engineer responding to each alert. Talk to us about covering your DAO's governance and treasury accounts.

Talk to Guardian Explore the service