USDBonkDAO Treasury Drained in Governance Attack
Malicious Proposal Moves Millions in BONK Tokens
TL;DR
- BonkDAO said a malicious governance proposal drained about $20 million worth of BONK from its treasury.
- More than 4.4 trillion BONK moved from the treasury before being transferred between Solana wallets.
- Upbit and Kraken paused BONK deposits and withdrawals after the incident.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
BonkDAO said it was hit by a malicious governance proposal on July 6, 2026, resulting in an estimated $20 million worth of BONK tokens being drained from the BonkDAO treasury, in an incident centered on governance approval rather than a confirmed Solana base-layer exploit.
BONK!!! disclosed the incident on X, saying, “BonkDAO was the target of a malicious governance proposal resulting in an estimated $20M worth of BONK tokens being drained from the BonkDAO treasury.” The statement placed the attack inside BonkDAO’s governance process, making the proposal itself the central mechanism behind the treasury movement.
The attack took place through BonkDAO’s governance system on Solana’s Realms platform, which uses token-weighted voting. Under that structure, governance influence is tied to token control, and the attacker reportedly accumulated a large BONK position through exchange wallets before the proposal went live.
Malicious Proposal Passed Through Governance
The treasury drain was tied to Bonk Improvement Proposal #76, titled “Sowellian BonkDAO.” The proposal claimed it sought to “implement Sowellian governance, install new members and council, rebuild from the ashes, monetize holdings, and stop the bleeding.”
The proposal also indicated that all “yes” voters would be eligible to receive BONK tokens. The tokens moved to the attacker-linked wallet were not distributed to other voters, despite that language.
Blockchain investigators estimated that the attacker spent roughly $4 million to buy enough BONK tokens to carry out the attack. The available information does not confirm whether those tokens were borrowed, flash-loaned, or accumulated gradually through exchanges.
Similar attacks have hit other Solana and cross-chain protocols between 2025 and 2026, sometimes using flash loans to borrow enough tokens to win a majority vote inside one transaction. The available information does not confirm that this attacker used a flash loan.
We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!
Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.
Treasury Transfers and Market Reaction
More than 4.4 trillion BONK tokens moved out of the treasury wallet around 4:00 a.m. ET on Monday, July 6, 2026. The transfer was valued at $19.3 million at the time of writing and was sent to an address ending in “JHvQ.”
Solscan identified the “JHvQ” wallet as being funded via a Bybit account. Around 3:30 p.m. ET, the tokens were transferred again to another Solana address ending in “eh42.”
COIN360 data showed BONK price trading at $0.00000421 on July 7, down about 11.7% over 24 hours.
BONK was also described as trading roughly 93% below its all-time high of $0.000058. The token, launched on Solana in December 2022, was described as a popular dog-themed meme coin and as once being among the top 100 crypto tokens by market capitalization.
Exchanges Pause BONK Movements
Upbit temporarily suspended BONK deposits and withdrawals after the attack. Upbit cited “user protection measures following the circumstances of a security incident” and told users that BONK deposits and withdrawals had been “temporarily suspended.”
Kraken also paused BONK deposits and withdrawals. The exchange suspensions followed tracking that showed the stolen BONK moving toward crypto exchanges, raising the urgency around fund tracing and movement controls.
BONK!!! said, “During the investigation, BonkDAO identified the exchange wallets used to purchase BONK ahead of the proposal.” The statement linked the governance attack to prior exchange-wallet activity used before the proposal was approved.
BonkDAO said it is working with centralized exchanges, network bridges, and the Solana Foundation to track the stolen money and try to freeze it before it disappears. BONK!!! also said, “Law enforcement has been notified. BonkDAO continues to work with relevant parties to recover funds and identify those responsible.”
No recovery timeline has been provided. The attacker has not been identified, and the available information does not provide a confirmed breakdown of where all stolen BONK went after the second transfer to the address ending in “eh42.”
FAQ
What happened to BonkDAO?
BonkDAO said a malicious governance proposal drained about $20 million worth of BONK from its treasury.
Was Solana itself exploited?
The available information does not say the Solana network was exploited.
Which exchanges paused BONK movements?
Upbit and Kraken paused BONK deposits and withdrawals.
Has BonkDAO recovered the funds?
No recovery was confirmed, and no recovery timeline was provided.
This article has been refined and enhanced by ChatGPT.
