An attacker purchased $4.4M worth of BONK to gain over 1% of total supply, meeting the quorum requirement, and passed a malicious proposal to transfer 4.43 trillion BONK from the treasury. The exploit was executed immediately after voting closed, exposing weaknesses in low-quorum, token-weighted DAO governance.
BonkDAO's governance required only 1% quorum with no timelock, allowing the attacker to buy enough voting power to pass the proposal with minimal opposition.
The attacker successfully drained approximately $20M from the BonkDAO treasury.
A user posts a thread explaining how the attacker bought BONK over the July 4th weekend, spent $4.4M to get just over 1% of total supply, and passed a proposal that transferred 4.43 trillion BONK. Only 7 wallets voted, and the attacker controlled 99.9% of the vote.
1 related posts from @ilhanEdu
4 related posts from @codewithimanshu, @vydamo_, @Hash_hopes, @deoriginalme_
HalbornSecurity tweets that BonkDAO lost $20 million due to a governance attack requiring only 1% quorum and no timelock. The attacker spent $4.4 million buying BONK to pass a hidden treasury transfer, executed immediately after voting closed.
