BonkDAO hack — July 2026

On 6 July 2026 an attacker drained roughly 4.426 trillion BONK, about $20 million, from the BonkDAO treasury by passing a governance proposal that transferred the funds to a wallet under their control. No smart contract was broken. The DAO's own voting machinery executed the transfer.

The attacker spent roughly $4.4 million buying BONK on exchanges to acquire just over 1 percent of the token's supply, which was the threshold the proposal needed to clear quorum. The proposal was filed on the Realms governance platform as BIP #76, "Sowellian BonkDAO", promised to rebuild the project and monetise its holdings, and offered incentives to voters who supported it. It passed with 882.38 billion BONK in favour against a quorum threshold of 879.95 billion, on a turnout of about 2.9 percent: seven wallets voted while more than 18,000 eligible holders did not. The recorded approval rate was 99.9 percent, with the attacker's wallets holding about 99.878 percent of the voting weight cast.

CoinDesk reported, citing Chainalysis and Lookonchain tracking, that within nine hours the attacker sent about $188,000 to an exchange, moved roughly $19 million into a multisig wallet and began selling around $5.3 million of the BONK bought to stage the vote.

BonkDAO confirmed the attack, saying it was the target of a malicious governance proposal resulting in an estimated $20 million of BONK being drained from the treasury, and that it had identified the exchange wallets used to buy BONK ahead of the vote. It said it was coordinating with exchanges, cross-chain bridges, the Solana Foundation and law enforcement. BONK fell about 8 percent. No funds have been recovered and no arrests have been reported.