BonkDAO's governance attack on Solana.

On July 6, an attacker moved about $20 million in BONK tokens out of the BonkDAO treasury by passing a proposal the treasury was built to obey.

BonkDAO's treasury spends on the authority of a token vote, not a signing key. Voting power is the token itself, so anyone who buys enough supply can approve a transfer. The attacker bought roughly $4 million of BONK on exchanges over several days, crossed the quorum alone, and voted through a transfer of 4.426 trillion tokens to a wallet they controlled. Seven addresses voted in total.

Every signature was valid. The contract executed a proposal that passed under the rules written for it.

A treasury governed by token votes treats a majority of the votes cast as the key. When turnout is low and the supply is liquid, that key can be bought on the open market.