BONK DAO Vote Hijack Drains $20 Million, Sending Meme Coin Down 18%

DAO Voting Rules Exploited in $20 Million Treasury Drain

BONK Drops 18% in a Day

Debate Intensifies Over Whether Deceptive Proposal Constitutes Fraud

A major theft has hit BONK, the flagship meme coin of the Solana ecosystem, after an attacker exploited the decentralized autonomous organization’s governance voting system to siphon off about $20 million in tokens. Because the transfer was executed through a formally valid vote and backed by concentrated buying power, the incident exposed clear weaknesses in decentralized decision-making structures.

On July 6, Bonk DAO said a malicious governance proposal, BIP #76, drained about 4.426 trillion tokens from its community treasury. That represented about 5% of BONK’s total supply of 87.99 trillion tokens. The tokens flowed into a single wallet, triggering sharp price volatility. BONK had been trading at about $0.0000049 before the news broke and then plunged roughly 18% almost immediately.

Smart-Contract Loophole Used in $20 Million Theft

The attack was carefully planned. On June 30, the attacker submitted a proposal titled “BIP #76 - Sowellian BonkDAO.” It was presented as a plan to introduce a so-called Sowellian governance model, appoint new members and committees, rebuild the DAO, and prevent losses by selling and monetizing its assets. The proposal also promised token rewards to everyone who voted yes, helping draw support from retail holders.

The attacker hid a smart-contract execution command that transferred tokens to a specific wallet within the proposal text. The attacker then bought about 88.23 billion BONK tokens on major crypto exchanges including Binance and Bybit to secure voting power.

Using those holdings, the attacker easily overwhelmed the 710 million no votes and pushed the measure through. As soon as voting ended on July 6, 4.426 trillion tokens were transferred to the attacker’s wallet in just 49 seconds. The fee for moving the $20 million haul was only 0.000105 SOL. The attacker then withdrew the tokens used in the vote. No action was taken to stop the proposal, even though it had been posted for six days.

Weak settings in Bonk DAO’s system also contributed to the breach. At the time, the quorum requirement was only 1% of total supply. There was no timelock function to delay execution after approval, and liquid tokens that had not been staked were still eligible to vote. In the end, tokens worth about $20 million were transferred to the attacker through a formally valid voting process.

Fraud or Lawful Transaction?

As the fallout widened, BONK said it had reported the case to judicial authorities and was working with crypto exchanges and the Solana Foundation to trace the funds. The episode has also reignited debate in legal and industry circles over the gray areas unique to DeFi systems run entirely by code. A central question is whether the theft can be prosecuted as wire fraud under US federal law.

To prove wire fraud, prosecutors must show both intent to deceive and a material false statement. The industry is split on whether those elements are present. Those favoring prosecution focus on the proposal’s stated plan to adopt Sowellian governance, arguing that it referred not to a vague idea but to an identifiable system. Because the executed code included no instructions for building that governance structure, they argue the proposal amounted to a clear false promise. In that view, the defense that the code was executed transparently as written tells only part of the story because the proposal itself was designed to mislead voters.

Others say a fraud case would be difficult to sustain. The attacker had already accumulated enough tokens in advance to pass the proposal unilaterally. That makes it legally difficult to prove causation between the misleading language in the proposal and the transfer of funds. The question is whether the text was a deceptive act that caused the transfer, or merely decorative language that had no effect on the outcome.

The biggest variable may be the earlier Mango Markets case. In that episode, Avraham Eisenberg inflated the price of the MNGO token through futures trades and then extracted about $110 million in crypto assets using the inflated holdings as collateral. His initial conviction was later overturned, and he was ultimately acquitted. The court found insufficient evidence of falsity because Mango Markets had no explicit borrowing guidelines or terms of use. The ruling did not mean exploiting code was itself legal. It meant legal deception was harder to establish in the absence of written rules or promises.

An industry official said the case raises broader questions about how to legally police decentralized ecosystems that run entirely on code. Regulatory changes are urgently needed to prevent legally structured fraud that exploits smart-contract loopholes, the person added.