BONK DAO’s chain-based governance system was used in bad faith and approximately $20 million of BONK coins were transferred from the project’s treasury. The attackers first bought a sufficient number of BONKs in the secondary market to meet the minimum participation threshold required for the adoption of the proposal, and then facilitated the entry into force of a proposal for the transfer of treasury assets to their control wallets.

The attackers bought the voting threshold for about $4.4 million.

According to reports, this operation began on 30 June. At that time, an anonymous wallet submitted a proposal to transfer the treasury assets held by BONK DAO to the wallet under its control.

For the proposal to enter into force, an affirmative vote equal to 1 per cent of the total supply of BONK would be required. From 4 to 5 July, another wallet bought BONK in Bybit and Binance, at a cumulative cost of approximately US$ 4.4 million, and the size of the holdout reached this threshold. The chain observers also claimed that the attackers could have raised further funds through the DeFi lending platform.

Participation rate of less than 3 per cent

The proposal, entitled “BIP #76 - Sowellian BonkDAO”, ended up with only seven wallets voting, more than 18,000 members not voting, with a participation rate of only 2.9 per cent.

As a result, the proposal is almost on the line. In favour: 8,82.38 billion BONK, slightly above the threshold of 8,79.95 billion. The approval rate of 99.9 per cent is largely determined by a single large amount of the attackers.

On 6 July, after the vote, approximately $20 million of BONK was automatically transferred from the treasury to the attackers ' wallet. It is also a critical step in the direct use of the self-enforcement mechanisms of the chain of governance.

The money goes out and sells money.

Chainalysis states that approximately US$ 188,000 of the approximately 9 hours after the transfer of the treasury to the exchange is suspected of being used for liquidation. The remaining approximately $19 million was transferred to an additional wallet.

It was also reported that, more than an hour after the transfer of State Treasury funds, the attackers began to sell BONK, which they had previously bought to vote, on a cumulative scale of approximately $5.3 million. In other words, the attackers retained the coins that had been transferred from the treasury but began to withdraw from the hold held temporarily to seize the power of government.

BONK DAO has collaborated with the Exchange and the Solana Foundation

BONK DAO subsequently confirmed that it had been attacked by the malicious governance proposal and stated that it was working with the relevant exchange, the Trans-Cyber Bridge and the Solana Foundation to address the subsequent effects. The project party indicated that the attackers had been identified as having been used to buy exchange wallets in coins prior to the vote.

The incident once again revealed the fragility of the currency vote: Security depends on the cost of taking a majority vote when the control of the treasury is fully vested in a public vote and the right to vote is bought on the market for a short period. The cost to the attackers in this incident was significantly lower than the size of the assets they eventually acquired.