BonkDAO Treasury Governance Attack (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3DDaRr…AEFJSummary
On July 6, 2026, an unidentified attacker drained approximately $20 million in BONK tokens from BonkDAO's treasury on Solana's Realms governance platform by spending roughly $4.4 million to acquire just over 1% of BONK's circulating supply, meeting the DAO's quorum threshold and passing Bonk Improvement Proposal #76 with 99.9% approval across only seven voting wallets — a turnout of 2.9%. The attack exploited three compounding structural design failures — a permissively low quorum floor, no execution timelock, and no multisig safeguard — rather than any smart contract code vulnerability, and is widely characterized as the most significant governance-attack-as-exploit in Solana DAO history.
Connected Entities
2 entities- EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42→mentioned with→BonkDAO Treasury Governance Attack (July 2026)(50%)
Community submissions
- Under reviewincriminatingWayback pending8/14/2026, 4:12:10 PM
“CryptoTimes August 7 covers Upbit delisting announcement and resulting BONK 3-year-low crash. New regulatory action against BonkDAO — material update to existing investigation.”
— avoid-scout
Timeline(5 events)
30 June 2026
Anonymous wallet submitted Bonk Improvement Proposal #76 (BIP-76 – Sowellian BonkDAO) to BonkDAO's governance system on Realms. The proposal was framed as organizational restructuring but contained a hidden instruction to transfer 4.43 trillion BONK to an attacker-controlled wallet.
CryptoTicker / crypto.news4 July 2026
Attacker began accumulating BONK tokens through purchases on Bybit and Binance and reportedly via a $4 million loan from the MarginFi protocol, spreading purchases across multiple wallets over two days to avoid detection.
CoinDesk / Phemex5 July 2026
Attacker completed token acquisition, holding approximately 882.38 billion BONK — just above the 879.95 billion quorum threshold representing 1% of circulating supply. Total acquisition cost approximately $4.4 million.
CryptoTicker6 July 2026
BIP-76 passed with 99.9% of votes cast (seven wallets in favor, 18,000+ holders abstaining, 2.9% total turnout). Attacker-linked wallets controlled approximately 99.878% of votes. Realms executed the treasury transfer automatically, moving 4.43 trillion BONK (approximately $19.3-$21 million) to attacker wallet ending in JHvQ. By 3:30 p.m. ET, funds moved to secondary address EXaJnmrLf7RAKLfn1hehoKX94keKYmvZm5H5zuYVeh42 (ending in eh42). Approximately $148,000-$188,000 transferred to OKX; approximately $5.3 million reportedly sold.
CryptoTicker / Solana Floor / CoinDesk7 July 2026
BonkDAO publicly confirmed the attack. BONK price fell 7%-10% in the following 24 hours. Exchanges Upbit and Kraken suspended BONK deposits and withdrawals. BonkDAO announced coordination with the Solana Foundation, exchanges, bridge operators, and law enforcement. On-chain analyst Specter published preliminary attribution findings linking attacker wallets to the Realms platform founder and crypto_notte via shared exchange deposit addresses, explicitly caveated as incomplete and non-conclusive.
CoinDesk / CryptoAdventure / DecryptDecision Log
- hash: 9kiieuhkz1V5C29baE1fnpSKWyN68ATqi3RdETCRRJUd
- hash: 8PRZuADPzXS3EvweFW8sLer2sXB8iVqnULKNkHSVChph
- hash: 4fhcDqF1KPe9fEs8NYMrkyRngk13oANWSSbdnZbuUAJf
This investigation is cryptographically anchored to the Solana blockchain (3 events). 24 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/2/2026, 5:17:42 PM
last updated: 8/26/2026, 12:22:37 PM
5 viewsavoid.net — verified advice for a post-truth world