BonkDAO Treasury Governance Attack (July 2026)
Incidents are rated for severity, not trust. The trust score is on BonkDAO.
Summary
On July 6, 2026, an unidentified attacker drained approximately $20 million in BONK tokens from BonkDAO's treasury on Solana's Realms governance platform. The attacker spent roughly $4.4 million to acquire just over the 1% quorum threshold, then passed Bonk Improvement Proposal #76 with 99.9% approval across only seven voting wallets, a turnout of about 2.9%. The attack exploited three compounding governance design failures (a low quorum floor, no execution timelock and no multisig safeguard) rather than any smart contract bug, and is widely described as the most significant governance-attack-as-exploit in Solana DAO history.
Connected Entities
14 entities · 59 linked investigations- BonkDAO→mentioned with→Solana(80%)
- BonkDAO→mentioned with→Kraken(65%)
- EXaJnm…eh42→mentioned with→BonkDAO Treasury Governance Attack (July 2026)(50%)
- Ethereum→mentioned with→Coinbase(60%)
- Bonk→mentioned with→Solana(80%)
- BonkDAO Treasury Governance Attack→mentioned with→Solana(80%)
- BonkDAO Treasury Governance Attack→mentioned with→BonkDAO(80%)
- BonkDAO Treasury Governance Attack→mentioned with→Coinbase(60%)
- BonkDAO Treasury Governance Attack→mentioned with→Binance(70%)
- Binance→mentioned with→Ethereum(65%)
- + 21 more
Connected Through
11 shared actors · 573 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □Binanceorganization
- □Solanaorganization
- ♦Coinbasetoken
6 submissions awaiting moderator review.
Timeline(7 events)
June 2026
Anonymous wallet submits Bonk Improvement Proposal #76 ('BIP #76 - Sowellian BonkDAO') on Realms, framed as organizational restructuring but containing a hidden instruction to transfer 4.43 trillion BONK to an attacker-controlled wallet.
CryptoTicker / crypto.news / CoinDeskJuly 2026
Attacker begins accumulating BONK on Bybit and Binance, reportedly also using a $4 million MarginFi loan, spreading purchases across multiple wallets to avoid detection.
CoinDesk / PhemexJuly 2026
Attacker completes acquisition of ~882.38 billion BONK, just above the 879.95 billion (1%) quorum threshold, at a cost of ~$4.4 million.
CryptoTickerJuly 2026
BIP-76 passes with 99.9% approval from seven wallets (2.9% turnout; attacker-linked wallets ~99.878% of votes). Realms automatically transfers 4.43 trillion BONK (~$19.3-$21 million) to the attacker wallet ending in JHvQ.
CoinDesk / The Block / Solana FloorJuly 2026
By 3:30 p.m. ET funds move to secondary address EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42 (~$19 million, described by CoinDesk as a secondary multisig wallet); ~$148,000-$188,000 sent to OKX and ~$5.3 million reportedly sold or offloaded to exchanges.
CoinDesk / CryptoTickerJuly 2026
BonkDAO publicly confirms the attack; BONK falls roughly 7-10%; Upbit and Kraken suspend BONK deposits and withdrawals; BonkDAO announces coordination with exchanges, bridges, the Solana Foundation and law enforcement. Specter publishes preliminary, explicitly non-conclusive attribution findings.
CoinDesk / CryptoTimes / CryptoAdventureJuly 2026
Halborn publishes a post-mortem identifying the low quorum, missing timelock and missing multisig as root causes; attorney Carlo D'Angelo publishes analysis arguing on-chain compliance does not preclude civil or criminal liability.
Halborn / D'Angelo LegalDecision Log
- slot 457542501 · hash CxapDsregereMvhg9cTHNSFkyExVrWfxRRfC3zJB21N5
- slot 443521071 · hash 9kiieuhkz1V5C29baE1fnpSKWyN68ATqi3RdETCRRJUd
- slot 443521068 · hash 8PRZuADPzXS3EvweFW8sLer2sXB8iVqnULKNkHSVChph
- slot 443503600 · hash 4fhcDqF1KPe9fEs8NYMrkyRngk13oANWSSbdnZbuUAJf
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 30 of 32 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/2/2026, 5:17:42 PM
last updated: 10/2/2026, 5:29:43 AM
7 viewsavoid.net — verified advice for a post-truth world