BONK faces $20 million treasury drain after attacker spends $4 million to pass malicious proposal

The sequence began on June 30, when an anonymous wallet submitted a proposal to transfer the treasury’s holdings to a wallet it controlled, per Chainalysis. To pass, the proposal needed yes votes equal to 1% of BONK’s supply, the quorum, or minimum participation, required for it to take effect.

Over July 4 and 5, a separate wallet acquired exactly that much, spending about $4.4 million to buy BONK on the exchanges Bybit and Binance and, by one account, borrowing more through DeFi lending platforms, according to Lookonchain.

Titled “BIP #76 – Sowellian BonkDAO,” the proposal passed with just seven wallets voting, against more than 18,000 members who did not, a turnout of 2.9%.

It cleared quorum by the narrowest margin, 882.38 billion BONK in favor against a 879.95 billion threshold, almost exactly the stake the attacker had spent days assembling.

The 99.9% “yes” result was effectively a single voter agreeing with itself. Its written pitch read less like a governance motion than a boast, promising to “rebuild from the ashes, monetize holdings, stop the bleeding,” with a line noting that “all YES voters are eligible to receive tokens.”

Beneath it sat the only instruction that should have turned heads – a transfer of 4.43 trillion BONK to the attacker’s wallet.

By July 6 the voter held just enough. It cast its entire stake in favor, the proposal passed, and about $20 million in BONK automatically moved out of the treasury into the attacker’s wallet.