Memecoin treasury hack drains $20M in tokens

TLDR

A governance attack on BonkDAO drained around $20 million in BONK from the memecoins treasury using its own voting rules rather than a smart contract exploit.

1. An attacker spent about $4 million accumulating BONK, then passed a malicious proposal that moved roughly 4.4 trillion BONK from the maker/">DAO treasury to attacker-controlled wallets.
2. Losses are confined to the BonkDAO treasury, but BONK fell about 8 to 9 percent, and the incident highlights serious governance risks for DAOs that use simple token-weighted voting.
3. BonkDAO and partners are working with exchanges and law enforcement, while the community debates legal liability and pushes for guardrails like timelocks, higher quorums, and veto mechanisms.

Deep Dive

1. How The $20M Drain Happened

Multiple reports say an anonymous wallet proposed BIP #76 for BonkDAO, with text that included an instruction to transfer about 4.426 trillion BONK (roughly $20 to $21 million) from the treasury to the proposers address. CoinDesk and CryptoSlate report that over July 4 and 5 the attacker bought around $4.4 million of BONK on centralized exchanges and likely borrowed more to cross the quorum threshold.

Only seven wallets voted out of more than 18,000 eligible addresses, giving the attacker roughly 99 percent of the voting power and allowing the proposal to pass. Once approved, the DAOs smart contracts automatically executed the transfer. No underlying BONK or Solana contracts were hacked in the traditional sense.

Confidence: high based on consistent reporting across several independent outlets.

2. Why This Is A Governance, Not Code, Failure

Reports from Yahoo Finance and others stress that user wallets were not drained and BONKs token contract was not exploited. The vulnerability was in the governance design: token-weighted voting with low participation, a low quorum, and immediate execution.

Analyses at CryptoSlate and community threads highlight that if buying voting power costs less than the treasurys value, a DAO effectively has a takeover price. Legal commentary from u.today argues this looks like corporate fraud despite being valid on-chain, suggesting voters and organizers could face liability.

3. What To Watch Next

BonkDAO says it has identified exchange wallets used in the build-up to the vote and is working with exchanges, bridges, the Solana Foundation, and law enforcement to trace and potentially freeze funds. The Defiant reports that most of the loot now sits in a new BONK 2.0 multisig DAO, making the attackers intentions unclear.

Governance discussions are focusing on adding timelocks before treasury moves, higher quorum thresholds, proposal review windows, and emergency veto or council checks. For BONK specifically, market reaction, any partial recovery, and concrete governance changes will shape whether confidence returns.

Conclusion

This incident shows that a memecoin treasury can be emptied without breaking code when governance lets concentrated voting power push through complex transfers under low scrutiny. For crypto users, it is a reminder that DAO design, turnout, and safeguards are central to treasury security and should be part of any risk assessment for community-driven tokens.