Someone just bought their way into controlling an entire DAO treasury. And the worst part? They did it completely within the rules.
A single wallet spent approximately $4.4 million acquiring BONK tokens on exchanges including Binance and Bybit in late June 2026, accumulating enough voting power to pass a governance proposal that automatically transferred roughly 4.426 billion BONK tokens, worth around $20 million, out of BonkDAO’s treasury and into the attacker’s wallet.
How a $4.4M bet turned into a $20M payday
Here’s the thing about BonkDAO’s governance structure on the Realms platform: it only required a 1% quorum to pass proposals. In English, that means if just 1% of eligible voting power showed up and said “yes,” a proposal would execute automatically. No human review. No time delay. No second opinion.
The attacker understood this perfectly. After accumulating enough BONK tokens to command more than 99% of the votes on any given proposal, they submitted BIP #76 around June 30, 2026. The proposal, which effectively authorized the transfer of the entire treasury to the attacker’s wallet, went to a vote.
