{"investigation":{"slug":"bonqdao","entity_name":"BonqDAO","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.87,"status":"published","content_type":"investigation","summary":"BonqDAO was a Polygon-based decentralized lending protocol that launched in December 2022, offering zero-interest borrowing against crypto collateral with a native euro-pegged stablecoin (BEUR). On February 1, 2023, the protocol suffered a critical oracle manipulation exploit in which an attacker staked approximately $175 worth of TRB tokens to manipulate the Tellor price feed for the WALBT collateral token, minting 100 million BEUR against near-zero collateral and liquidating other users for an additional 113 million WALBT, resulting in nominal losses of approximately $120 million. BonqDAO's TVL fell by over 99% following the attack; a successor protocol (3A DAO) was subsequently launched by the team but BonqDAO itself remains effectively defunct.","sections":[{"content":"On February 1, 2023, an unknown attacker exploited a critical vulnerability in BonqDAO's integration with the Tellor decentralized oracle network on Polygon. By staking only 10 TRB tokens (valued at approximately $175), the attacker gained the minimum required stake to submit price updates to the TellorFlex oracle. The attacker called the submitValue function to report the price of Wrapped AllianceBlock Token (WALBT) at an artificially inflated level of 5,000,000 USD per token. Because BonqDAO consumed the instantaneous oracle value without any time-delay or manipulation guard, the inflated price was immediately accepted. The attacker deposited a nominal 0.1 WALBT as collateral and borrowed 100 million BEUR stablecoins against the fraudulent valuation. Approximately two minutes later, the attacker submitted a second oracle update driving the WALBT price to near zero, triggering liquidation of over 30 other users' undercollateralized troves. Through these liquidations, the attacker collected approximately 113.8 million WALBT tokens. The attacker address is 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642. Key transactions include borrowing transaction 0x31957ecc43774d19f54d9968e95c69c882468b46860f921668f2c55fadd51b19 and liquidation transaction 0xa02d0c3d16d6ee0e0b6a42c3cc91997c2b40c87d777136dedebe8ee0f47f32b1. The attacker was funded via Tornado Cash prior to the attack and laundered approximately 1,105 ETH through Tornado Cash beginning February 3, 2023. Due to low on-chain liquidity for BEUR and WALBT, the attacker's realized gains were limited to approximately $1.7 million in ETH and DAI, with 89 million ALBT tokens remaining largely illiquid.","heading":"Oracle Manipulation Exploit (February 2023)","sources":[{"url":"https://rekt.news/bonq-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://blocksec.com/blog/bonq-dao-exploited-on-polygon-120-m-stolen-due-to-flawed-logic","name":"blocksec.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-bonqdao-hack-february-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://hacken.io/insights/bonqdao-hack/","name":"hacken.io","type":"other","credibility":3},{"url":"https://medium.com/immunefi/hack-analysis-bonqdao-february-2023-ef6aab0086d6","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Post-mortem analysis by multiple security firms identified that the contracts directly involved in the exploit — specifically ConvertedPriceFeed, ChainlinkPriceFeed, and TellorPriceFeed — were never within the scope of any security audit. BonqDAO had engaged Omniscia to audit its codebase, and that audit raised concerns about multiple vulnerabilities and core design flaws. However, the protocol team subsequently made significant architectural changes, including the Tellor oracle integration, after the Omniscia audit was finalized. These changes were deployed to production without independent security review. The core flaw was that the BonqDAO system consumed the most recent Tellor oracle value instantaneously within the same transaction, without any time-weighted average price (TWAP) mechanism, staleness check, or manipulation threshold. Researcher samczsun summarized the trust model problem as: the attacker told the oracle that 1 ALBT equaled 5 billion MATIC, and Bonq accepted it. This class of vulnerability — instant oracle price consumption combined with low-cost oracle update rights on Tellor — had been identified in prior analyses of the Tellor oracle model but was not addressed in the BonqDAO implementation.","heading":"Root Cause: Unaudited Price Feed Contracts","sources":[{"url":"https://rekt.news/bonq-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://omniscia.io/reports/bonq-borrowing-protocol/","name":"omniscia.io","type":"other","credibility":3},{"url":"https://hacken.io/insights/bonqdao-hack/","name":"hacken.io","type":"other","credibility":3},{"url":"https://blockapex.io/bonqdao-hack-analysis/","name":"blockapex.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The nominal value of assets affected by the exploit was approximately $120 million, comprising $108 million in 98.65 million BEUR tokens and approximately $11 million in 113.8 million WALBT tokens, according to PeckShield analysis. However, thin on-chain liquidity substantially reduced actual realized losses: the attacker converted roughly $1.7 million in ETH and DAI before exit routes became constrained. BonqDAO's total value locked (TVL) collapsed from approximately $13 million to under $44,000 — a decline of over 99.6% — within hours of the attack. The BEUR stablecoin lost its peg catastrophically, trading as low as $0.15 on February 3, 2023. AllianceBlock's ALBT token, which served as collateral within the protocol, fell more than 51% in value following the hack due to the attacker dumping stolen WALBT/ALBT on secondary markets. AllianceBlock (later rebranded as Nexera) publicly stated that none of its own smart contracts were breached or compromised during the attack, clarifying that the vulnerability resided entirely within BonqDAO's oracle integration. AllianceBlock paused all bridge activity and coordinated with exchanges to halt trading.","heading":"Financial Impact and Token Damage","sources":[{"url":"https://cointelegraph.com/news/lack-of-liquidity-mitigated-damages-to-bonqdao-exploit-report","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/02/01/allianceblock-token-plunges-51-after-5m-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://medium.com/allianceblock/allianceblock-issues-statement-in-response-to-bonqdao-hack-6510a61fcf5c","name":"medium.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/bonq-dao-exploited-on-polygon-120-m-stolen-due-to-flawed-logic","name":"blocksec.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/bonqdao","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the attack, BonqDAO paused the protocol and announced a recovery plan. On February 27, 2023, BonqDAO initiated a community governance vote. On March 5, 2023, the BNQ token vote concluded with the community expressing support for a protocol reboot and for the executive team led by CEO Delia Sabau. AllianceBlock announced a compensation airdrop of newly minted ALBT tokens to affected users based on a snapshot taken immediately before the attack. Michal Bacia, who served as Chief Economist at BonqDAO, publicly stated that he had worked for the protocol without founder tokens and relinquished any future BNQ token allocation to contribute to user compensation. The team subsequently launched 3A DAO as a successor lending protocol with revised security architecture, offering zero-interest borrowing against crypto and real-world asset collateral. As of available data in 2025, BonqDAO's TVL remains at approximately $334, indicating the original protocol is effectively defunct. No public law enforcement action, criminal charges, or regulatory filings related to the exploit have been identified in available sources.","heading":"Protocol Response and Recovery Attempts","sources":[{"url":"https://blog.3adao.org/introducing-bonqdao-2-0-our-journey-to-relaunch-the-protocol-2f761dffc024","name":"blog.3adao.org","type":"other","credibility":3},{"url":"https://www.3adao.org","name":"3adao.org","type":"other","credibility":3},{"url":"https://defillama.com/protocol/bonqdao","name":"defillama.com","type":"other","credibility":3},{"url":"https://medium.com/allianceblock/allianceblock-issues-statement-in-response-to-bonqdao-hack-6510a61fcf5c","name":"medium.com","type":"other","credibility":3},{"url":"https://paragraph.com/@bonqdaoblog","name":"paragraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Delia Sabau served as Chief Executive Officer of BonqDAO and is also listed as co-founder of 3A DAO. Prior to BonqDAO she held roles including Senior Portfolio Manager at Menta Capital LLC and Principal Portfolio Manager at BlackRock, and is also listed as an advisor to Finsera. Michal Bacia served as Chief Economist at BonqDAO and participated in public panels representing the protocol at events such as the World of Web3 summit in November 2022. Micha Roon is associated with the team in publicly available LinkedIn posts. The identities of the attacker(s) remain unknown. No formal attribution to any named individual or group has been established by law enforcement or on-chain investigators in sources reviewed for this report.","heading":"Key Personnel","sources":[{"url":"https://www.linkedin.com/in/michalbacia/","name":"linkedin.com","type":"other","credibility":3},{"url":"https://theorg.com/org/finsera/org-chart/delia-sabau","name":"theorg.com","type":"other","credibility":3},{"url":"https://www.youtube.com/watch?v=3CWUGMVwcFw","name":"youtube.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The attacker's primary address on Ethereum is 0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642. Pre-attack funding was sourced from Tornado Cash, a sanctioned cryptocurrency mixer. Post-attack, the attacker laundered approximately 1,105 ETH through Tornado Cash beginning February 3, 2023. The attacker bridged stolen WALBT from Polygon to Ethereum and attempted to swap large volumes of ALBT on decentralized exchanges. Low liquidity constrained the attacker's ability to fully monetize the stolen tokens. No recovery of stolen funds has been reported in available sources.","heading":"On-Chain Threat Indicators","sources":[{"url":"https://rekt.news/bonq-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://blocksec.com/blog/bonq-dao-exploited-on-polygon-120-m-stolen-due-to-flawed-logic","name":"blocksec.com","type":"other","credibility":3},{"url":"https://hacken.io/insights/bonqdao-hack/","name":"hacken.io","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-12-15","event":"BonqDAO launches on Polygon as a zero-interest lending protocol with BEUR euro-pegged stablecoin.","source":""},{"date":"2023-02","event":"Attacker (0xcacf2d28b2a5309e099f0c6e8c60ec3ddf656642) manipulates TellorFlex oracle for WALBT, minting 100 million BEUR and liquidating 30+ user troves to collect 113.8 million WALBT. Nominal losses estimated at $120 million.","source":"","date_original":"2023-02-01"},{"date":"2023-02","event":"AllianceBlock pauses bridge activity and issues public statement clarifying its own contracts were not breached. ALBT token price falls more than 51%.","source":"","date_original":"2023-02-01"},{"date":"2023-02-03","event":"Attacker begins laundering approximately 1,105 ETH through Tornado Cash. BEUR falls to $0.15 low.","source":""},{"date":"2023-02-03","event":"BonqDAO's TVL falls from approximately $13 million to under $44,000 — a 99.6% decline.","source":""},{"date":"2023-02-27","event":"BonqDAO launches community governance vote on protocol recovery plan.","source":""},{"date":"2023-03-05","event":"BNQ governance vote concludes with community support for reboot and executive team. AllianceBlock begins ALBT airdrop compensation for affected users.","source":""},{"date":"2023-05-17","event":"Team publishes announcement of 3A DAO as successor lending protocol, describing the relaunch journey.","source":""},{"date":"2024-02-16","event":"3A DAO announces collaboration with Constellation Network (DAG), indicating continued successor protocol development.","source":""}],"sources_used":[{"url":"https://rekt.news/bonq-rekt","name":"BonqDAO — REKT News","type":"news_article","archive_url":"http://web.archive.org/web/20260513160332/https://rekt.news/bonq-rekt","credibility":2,"archive_timestamp":"2026-05-13T16:03:32+00:00"},{"url":"https://blocksec.com/blog/bonq-dao-exploited-on-polygon-120-m-stolen-due-to-flawed-logic","name":"BonqDAO Exploited on Polygon: $120M Stolen Due to Flawed Logic — BlockSec","type":"research","archive_url":"http://web.archive.org/web/20260209112159/https://blocksec.com/blog/bonq-dao-exploited-on-polygon-120-m-stolen-due-to-flawed-logic","credibility":2,"archive_timestamp":"2026-02-09T11:21:59+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-bonqdao-hack-february-2023","name":"Explained: The BonqDAO Hack (February 2023) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260605225746/https://www.halborn.com/blog/post/explained-the-bonqdao-hack-february-2023","credibility":2,"archive_timestamp":"2026-06-05T22:57:46+00:00"},{"url":"https://hacken.io/insights/bonqdao-hack/","name":"The BonqDAO Price Oracle Hack Explained — Hacken","type":"research","archive_url":"http://web.archive.org/web/20260309210343/https://hacken.io/insights/bonqdao-hack/","credibility":2,"archive_timestamp":"2026-03-09T21:03:43+00:00"},{"url":"https://medium.com/immunefi/hack-analysis-bonqdao-february-2023-ef6aab0086d6","name":"Hack Analysis: BonqDAO, February 2023 — Immunefi","type":"research","archive_url":"http://web.archive.org/web/20251126142046/https://medium.com/immunefi/hack-analysis-bonqdao-february-2023-ef6aab0086d6","credibility":2,"archive_timestamp":"2025-11-26T14:20:46+00:00"},{"url":"https://www.coindesk.com/business/2023/02/01/allianceblock-token-plunges-51-after-5m-exploit","name":"AllianceBlock Token Plunges 51% After $5M Exploit of Bonq DAO — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260511091126/https://www.coindesk.com/business/2023/02/01/allianceblock-token-plunges-51-after-5m-exploit","credibility":1,"archive_timestamp":"2026-05-11T09:11:26+00:00"},{"url":"https://cointelegraph.com/news/lack-of-liquidity-mitigated-damages-to-bonqdao-exploit-report","name":"Lack of liquidity mitigated damages to BonqDAO exploit: Report — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250818163030/https://cointelegraph.com/news/lack-of-liquidity-mitigated-damages-to-bonqdao-exploit-report","credibility":1,"archive_timestamp":"2025-08-18T16:30:30+00:00"},{"url":"https://medium.com/allianceblock/allianceblock-issues-statement-in-response-to-bonqdao-hack-6510a61fcf5c","name":"AllianceBlock Issues Statement in Response to BonqDAO Hack — AllianceBlock/Nexera Medium","type":"official","archive_url":"http://web.archive.org/web/20260726032729/https://medium.com/allianceblock/allianceblock-issues-statement-in-response-to-bonqdao-hack-6510a61fcf5c","credibility":2,"archive_timestamp":"2026-07-26T03:27:29+00:00"},{"url":"https://omniscia.io/reports/bonq-borrowing-protocol/","name":"Omniscia Bonq Borrowing Protocol Audit","type":"research","archive_url":"https://web.archive.org/web/20260725123806/https://omniscia.io/reports/bonq-borrowing-protocol/","credibility":2,"archive_timestamp":"2026-07-25T12:38:06+00:00"},{"url":"https://defillama.com/protocol/bonqdao","name":"BonqDAO TVL — DeFiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250814203405/https://defillama.com/protocol/bonqdao","credibility":2,"archive_timestamp":"2025-08-14T20:34:05+00:00"},{"url":"https://blog.3adao.org/introducing-bonqdao-2-0-our-journey-to-relaunch-the-protocol-2f761dffc024","name":"Introducing 3A DAO: Our Journey to Relaunch the Protocol","type":"official","archive_url":"https://web.archive.org/web/20260725083318/https://blog.3adao.org/introducing-bonqdao-2-0-our-journey-to-relaunch-the-protocol-2f761dffc024?gi=8e41f1545ca4","credibility":2,"archive_timestamp":"2026-07-25T08:33:18+00:00"},{"url":"https://blockapex.io/bonqdao-hack-analysis/","name":"BonqDAO Hack Analysis — BlockApex","type":"research","archive_url":"http://web.archive.org/web/20260414002631/https://blockapex.io/bonqdao-hack-analysis/","credibility":2,"archive_timestamp":"2026-04-14T00:26:31+00:00"},{"url":"https://www.linkedin.com/in/michalbacia/","name":"Michal Bacia LinkedIn — Chief Economist at BonqDAO","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://theorg.com/org/finsera/org-chart/delia-sabau","name":"Delia Sabau — The Org (Finsera Advisor profile)","type":"other","archive_url":"https://web.archive.org/web/20260724172846/https://theorg.com/org/finsera?p=delia-sabau","credibility":3,"archive_timestamp":"2026-07-24T17:28:46+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:44.886073+00:00","updated_at":"2026-08-29T01:34:23.598+00:00"}}