BonkDAO Loses $20 Million in Malicious Governance Proposal Attack
BonkDAO is the decentralized autonomous organization behind the Solana memecoin BONK, with treasury decisions determined by token-weighted voting. The incident was not a smart-contract exploit. Instead, the attacker capitalized on low voter turnout and a 1% quorum threshold to buy voting power, highlighting how concentrated capital can turn DAO governance against itself.
An anonymous wallet submitted BIP #76 on June 30, 2026, then spent about $4.4 million to acquire 882.38 billion BONK from July 4 to 5. The proposal passed on July 6 with 99.9% support, allowing the wallet to transfer 4.43 trillion tokens worth about $20 million. BonkDAO has contacted law enforcement and is coordinating with exchanges and the Solana Foundation to recover the funds. BONK fell about 7% at one point.
All Coverage
5 original reportsThe Backstory
The history behind this eventSolana Token Launchpad Bonk.fun Hit by Domain Hijacking and Wallet Drainer
Bonk.fun, formerly known as LetsBONK, is a Solana memecoin launchpad backed by Raydium and BONK that went live in April 2025. The incident did not involve a smart-contract exploit. Instead, attackers gained control of the official domain and team accounts, underscoring how a crypto service’s front end can also become a gateway for stealing wallet assets.
Bonk.fun confirmed on X on March 12, 2026, that its domain had been hijacked and that hackers had planted a wallet drainer disguised as a terms-of-service message. The platform immediately told users to stop visiting the site. Operator Tom said only users who signed the fraudulent message after the breach were affected. Those who had previously connected to the site or traded through third-party terminals were not affected. The amount lost has not been disclosed.
Subscribe to Mark Radar Weekly
Every Friday, the week's strongest signals in your inbox. Unsubscribe anytime.