BonkDAO: $4.4M Bought the Vote That Paid Out $20M, All by the Rules

At 09:42 UTC on 6 July 2026, a vote closed in an online community that runs one of the best-known joke coins in crypto. The result was 99.9% in favour. In the same instant, about $20 million left the community's savings account and landed in a wallet belonging to the person who had proposed the vote. No code was broken. No password was stolen. The system did exactly what it had been built to do.

The community was BonkDAO, which looks after BONK, a memecoin on the Solana blockchain. A memecoin is a token that started as a joke and trades mostly on mood, the crypto equivalent of a penny stock with a dog mascot. Solana is the network it runs on, a shared public ledger that records who owns what. BonkDAO is a DAO, short for decentralised autonomous organisation: a club with no board of directors, where token holders vote on decisions much as shareholders vote at an annual meeting. The difference is what happens after the vote. At a company, a passed resolution still has to be carried out by people. At BonkDAO, a passed proposal was carried out by the software itself, automatically, with nobody in between.

A proposal dressed as a pep talk

On 30 June an anonymous wallet filed a proposal titled "BIP #76, Sowellian BonkDAO" on Realms, the Solana voting platform the DAO used. It read like a motivational speech. It talked about rebuilding from the ashes and stopping the bleeding, and it promised that everyone who voted yes would be eligible for a reward. Inside it was the one instruction that mattered: transfer 4,426,104,450,305 BONK, about 4.43 trillion tokens, from the DAO treasury to an address the proposer controlled. The treasury is the club's shared money, the pot meant to pay for marketing, grants and development.

Filing it was cheap. Anyone holding 100 million BONK, worth a few hundred dollars, could put a proposal on the ballot. The rules then said a proposal passed if it reached a quorum, the minimum turnout a vote needs to count, set at 1% of the token supply. That worked out at 879.95 billion BONK.

Buying the room

On 4 and 5 July a second wallet went shopping. It bought BONK on two big exchanges, Bybit and Binance, which work like brokers where anyone can buy the token with ordinary money, and topped up the position with tokens borrowed through marginfi, a Solana lending app that works like a margin account. Blockchain analysts at Lookonchain put the purchase cost at about $4.4 million. By the end the wallet held about 882 billion BONK, just over 1% of supply. The attacker was not buying an investment. It was buying exactly enough votes to clear the bar on its own.

On 6 July it voted. The final count was 882,383,387,283 BONK for and 710,848,288 against. BonkDAO had more than 18,000 members. Seven wallets voted. Turnout was 2.9%. One attacker wallet supplied 99.87% of the yes votes, according to the security firm QuillAudits. The proposal cleared quorum by about 2.4 billion BONK, a margin of roughly $11,000.

Then came the part that turned a bad vote into a theft. BonkDAO's settings had an "instruction hold-up time" of zero seconds. In plain terms there was no timelock, no cooling-off period between a vote passing and the money moving, of the kind a company would build in so a board could step in. Hypernative, a security monitoring firm, noted that the transfer executed the moment voting closed. The money moved in the same transaction that finalised the vote.

Where the money went

What followed was fast. About an hour after the vote, the voting wallet began selling. Within roughly nine hours about $188,000 of BONK went to the exchange OKX, a movement flagged by both PeckShield and Chainalysis. Most of the rest, about $19 million, went into a newly created multisig, a wallet that needs several keys to spend, like a joint bank account needing two signatures. Chainalysis described it as a "BONK 2.0" shadow DAO, controlled by the voting wallet, the receiving wallet and a third address with funding links to the voter. Hypernative reported that the attacker also withdrew the roughly $4.09 million of BONK it had staked to vote, which means the attack cost it close to nothing beyond trading costs and price risk.

The sell-off ran for two weeks. By PANews' count, 1.186 trillion BONK (about $4.11 million) went to Binance on 17 July, then two batches of 400 billion BONK, about $1.1 million each, went to Coinbase on 19 and 20 July. PANews tallied about $13.58 million cashed out in total. Over the twelve days after the drain, BONK fell from about $0.0000047 to $0.0000027, a drop of roughly 41%, which hurt every ordinary holder, not just the treasury.

BonkDAO posted on X about eight hours after the vote. It confirmed a malicious proposal and an estimated $20 million loss, said it had identified the exchange wallets used to buy the votes, and said it had notified law enforcement and was working with exchanges, bridges and the Solana Foundation. On 13 July it said the BONK token itself and users' own wallets were untouched and promised a full post-mortem. By mid-October that post-mortem had not been published, nobody had been named or charged, and no stolen funds had been reported frozen or returned.

Was it even theft?

Yu Xian, co-founder of the security firm SlowMist, said it was not a hack at all: the attacker spent about $4 million to control a vote nobody else bothered to attend. Preetam, co-founder of QuillAudits, called the setup "a loaded gun". BonkDAO and the analytics firms call it an attack, and the case has been reported to police. Both views hold. The attacker came in through the front door, with a key the DAO sold to anyone willing to pay.

It was not new, either. Months earlier, someone tried almost the same trick on hyUSD, a token run by the Reserve protocol, with a proposal that would have handed over its vault. Reserve's developers, ABC Labs, were alerted by Hypernative's monitoring software and warned holders, and enough of them voted no within 24 hours that the attacker gave up. In the weeks after BonkDAO, Term Finance and Neutron both lost money to bought or captured votes. The difference at BonkDAO was that nobody was watching the ballot.

The exchange that walked away

The longest-lasting consequence came from South Korea. On 7 July Upbit, the country's biggest exchange, paused BONK deposits and withdrawals and put the token on its caution list; Kraken also paused transfers. After a month-long review under South Korea's Virtual Asset User Protection Act, Upbit announced on 7 August that it would end BONK trading on 7 September 2026, citing security incidents whose causes were unresolved and a failure to disclose important matters promptly. Withdrawals stayed open until 7 October. BONK fell to its lowest price since late 2023 on the news. Bithumb, Upbit's main rival, reviewed the same facts and lifted its own warning the same day, so Korean holders were left with one big exchange where they could still trade the coin.

The arithmetic is the story. The treasury could be emptied by whoever held a temporary majority of the people who bothered to vote. That majority cost about $4.4 million, most of which the attacker got back. The prize was about $20 million.