BonkDAO, the governance arm of the Solana memecoin BONK, lost roughly $20 million from its treasury on July 6 after an attacker pushed a malicious proposal through its own voting system. The announcement came from BonkDAO's verified X account and was reported by Wu Blockchain early on July 7 UTC.
The striking detail is the cost of entry. According to reporting from The Record, the attacker accumulated about $4 million worth of BONK through exchange wallets before submitting the proposal, then used that stake to vote the treasury transfer through. A $4 million position unlocked a $20 million payout, a 5x return on capital that was never at risk of being rejected by code.
A Valid Vote, Not a Broken Contract
No smart contract was exploited here. Token-weighted voting approved a treasury transaction exactly as the governance rules allow. The proposal was malicious in intent, but on-chain it looked like any other passed vote: tokens were counted, the threshold was met, and the transfer executed.
That distinction matters for anyone holding tokens in a DAO-governed project. Audits, bug bounties, and formal verification target contract logic. None of them protect against a treasury that can be legally voted into a stranger's wallet by whoever shows up with enough tokens on decision day.
BonkDAO said its investigation identified the exchange wallets used to buy BONK ahead of the proposal, a pattern consistent with deliberate positioning rather than an opportunistic whale. The DAO reportedly held around 15% of the available BONK supply, making its treasury a concentrated, publicly visible target with a published price tag.
Law Enforcement, Exchanges, and Upbit Step In
BonkDAO says it has notified law enforcement and is working with cryptocurrency exchanges, cross-chain bridge operators, and the Solana Foundation to trace the funds and identify the attacker. South Korean exchange Upbit temporarily suspended BONK deposits and withdrawals, cutting off one of the larger liquidity venues an attacker could use to cash out.
The price reaction was immediate but not catastrophic. Reports on the drop range from about 7% by Monday afternoon Eastern time, per The Record, to more than 9% in other coverage. BONK's market capitalization sat near $400 million after the fall, which puts the $20 million drain at roughly 5% of the token's entire value.
The broader Solana market shrugged. SOL traded at $82.25 as of July 7, 2026, up 0.3% over 24 hours and 10.6% on the week, with the crypto Fear & Greed index at 30. The damage stayed contained to BONK holders and the DAO itself.
Governance Attacks Are Getting Cheaper Than Exploits
This is not a new attack class. The Defiant notes a comparable governance takeover in June drained $1.58 million from Balancer-linked TOP token pools. The pattern repeats because the economics favor the attacker: buying votes on the open market is legal, quiet, and reversible if the proposal fails. Writing an exploit for an audited contract is none of those things.
Memecoin DAOs are especially exposed. Their tokens are liquid and cheap to accumulate, their voter turnout is thin, and their treasuries are often large relative to the float actually participating in votes. A treasury worth $20 million guarded by an electorate that can be outvoted for $4 million is not a security posture. It is an open order book.
The defenses exist: proposal timelocks long enough for the community to react, quorum thresholds tied to circulating supply rather than turnout, veto councils for treasury movements above a size limit, and monitoring for sudden token accumulation before votes. Each one adds friction that memecoin communities have historically resisted. BonkDAO just demonstrated the price of that resistance.
Overview
An attacker spent about $4 million on BONK, submitted a malicious treasury proposal to BonkDAO, and voted it through, draining roughly $20 million on July 6, 2026. No contract was exploited; the governance process worked as designed. BonkDAO has notified law enforcement and is working with exchanges, bridges, and the Solana Foundation to trace funds, while Upbit paused BONK deposits and withdrawals. BONK fell between 7% and 9% on the news. For token holders, the lesson is blunt: a DAO treasury is only as safe as the cost of buying the votes that control it.
