DeFi Governance Attack Wave 2026

2026-06-09

Token of Power (TOP) governance attack on Ethereum: attacker acquires majority of 16,384-token supply through Tornado Cash-funded wallet, passes and executes a proposal minting 10 billion new tokens in a single transaction with no timelock, extracting approximately $1.58 million in ETH via Balancer V1.

2026-07-06

BonkDAO governance attack on Solana: attacker spends approximately $4.4 million to purchase over 1 percent of BONK supply, meeting quorum threshold and controlling ~99.878 percent of votes cast, passing a malicious proposal that transfers approximately 4.43 trillion BONK (~$20 million) from the treasury instantly.

2026-07-06

Attacker deposits 320,000 BOND tokens into BarnBridge staking contract, acquiring voting power in preparation for the subsequent BarnBridge SMART Yield governance attack.

2026-07-07

BonkDAO confirms attack publicly; states coordination with exchanges, Solana Foundation, and law enforcement. BONK token falls 8–10 percent.

2026-07-15

BarnBridge SMART Yield governance attack on Ethereum: attacker submits malicious governance proposal replacing the CompoundProvider controller with a malicious contract, sweeping approximately $776,000 from roughly 50 wallets holding legacy USDC approvals.

2026-08-06

Panther Protocol governance attack on Base: attacker exploits Reality.eth optimistic oracle with a misconfigured Base deployment, submitting malicious 'zkp-reexploit' upgrade proposal, allowing it to finalize unchallenged and draining 5.12 million ZKP (~$17,900). No user funds compromised.

2026-08-17

Term Finance attacker purchases approximately 0.4852 tmvETH for roughly 0.5 ETH, quietly accumulating approximately 90.66 percent of staked vault share voting power — six days before the attack execution.

2026-08-23

Term Finance governance exploit: attacker passes malicious proposals with 91–100 percent voting control across strategy vaults, withdrawing approximately 2,843 ETH and 1.68 million USDC ($8.5 million total). USDC swapped for DAI. PeckShield traces initial attacker funding to Tornado Cash.

2026-08-24

Term Labs publicly confirms the exploit, shuts down Meta Vaults permanently, revokes DAO governance roles, and states that core lending markets remain unaffected and withdrawals are preserved.