On July 6, BonkDAO suffered a governance attack in which approximately 4.4 trillion BONK tokens were transferred from the DAO vault, worth about $19.3 million at the time of the transfer. The incident did not involve theft of private keys or traditional contract vulnerabilities; rather, the attackers exploited the governance process itself to transfer the funds.

The funds were transferred to two addresses in succession.

On-chain data shows that these BONKs were transferred from the BonkDAO vault after 4 AM Eastern Time that day, first going to an address ending in JHvQ. Solscan records show that this address is related to the source of funds in the Bybit account.

Around 3:30 PM that day, the tokens were transferred to another Solana address ending in eh42. As of the time of this writing, there have been no records of further transfers from these two addresses to other addresses.

Malicious proposals approved through governance platform

This outflow of funds is related to Bonk Improvement Proposal #76. The proposal, titled "Sowellian BonkDAO," was submitted and approved through BonkDAO's proprietary governance platform. The proposal included changes to members and committees, the disposal of holdings, and claimed to distribute BONK rewards to addresses that voted in favor.

However, this reward was not delivered. The transferred tokens were not distributed to voters but were transferred to a second address several hours later. The original article states that the attackers bought enough BONK before the vote to gain sufficient governance weight and then pushed the proposal through on-chain.

The exchange has suspended BONK deposits and withdrawals.

BonkDAO later stated that it had identified the exchange wallets used to buy BONK prior to the proposal. This means that the related accumulated positions could be seen afterward, but were not intercepted in time.

Following the incident, both South Korean exchange Upbit and US exchange Kraken suspended BONK deposits and withdrawals. Upbit stated that this was a user protection measure following the security incident. BonkDAO stated on its X platform that it has notified law enforcement and is cooperating with centralized exchanges, network bridges, and the Solana Foundation to trace the funds.

In the market, BONK fell approximately 7% in the 24 hours following the incident, closing at around $0.0000043. If these tokens subsequently enter the liquid market, they could exert further selling pressure on the price.