BonkDAO: $20M in BONK drained via governance exploit

BonkDAO reported an unknown actor removed $20 million in BONK tokens from the project’s treasury on the Solana blockchain by using a malicious governance proposal. The disclosure appeared in a post on X on Monday.

Bonk is a dog-themed memecoin that launched in December 2022. Developers airdropped half of the token’s supply at launch. The reported transfer coincided with about a 7% drop in BONK’s price over 24 hours to roughly $0.05.

Governance rules let DAO members propose and vote on spending from a shared treasury. In this incident, the proposal was used to move assets out of the project vault. The actor’s identity has not been released and the DAO did not provide a timeline for recovering the tokens.

The DAO said it has notified law enforcement, opened an investigation and is seeking to recover the funds. BonkDAO wrote in its post: “We had informed law enforcement after the $20 million attack and are working to recover funds and identify those responsible.”

The post did not include technical details about how the proposal worked or whether multisig or other treasury controls were active when the tokens were moved.

In May, the memecoin launch platform DxSale reported losing about $7.3 million after a cyberattack that affected liquidity providers on the BNB Chain. Security specialists have warned the systems used to move stolen tokens can make tracing and recovery difficult.

Data from CoinMarketCap showed the combined market value of major memecoins at about $25.3 billion at the time of publication, down more than 54% over the prior 12 months. Earlier this year the group of tokens briefly fell to roughly $22 billion before recovering above $26 billion in July.