BonkDAO didn't get hacked. It got outvoted by $4M against a $20M treasury it left essentially unguarded, and that's a far more damning story. Let's be clear about what failed here, because "governance attack" is doing a lot of work to soften what was basically, incompetence. A proposal to drain the treasury sat live on Realms for six days. In that window, exactly seven wallets bothered to vote, for a treasury worth $20M USD. Nobody on the team, nobody in the community, nobody monitoring proposal activity flagged it. There was no review process, no alert system, no one at home it seems. Then there's the actual security architecture, or lack of one. No execution-time lock, meaning zero delay between a vote passing and the funds actually moving, so even if someone had noticed on day six, there was no window to intervene. No mandatory multisig override, meaning there was no emergency brake at all once a proposal cleared. These aren't exotic, cutting-edge protections, they're baseline safeguards for any DAO holding an eight-figure treasury in 2026, standard practice that BonkDAO simply didn't implement. This wasn't a sophisticated exploit that slipped past reasonable defenses, someone simply took their shot. $4M bought total control of a $20M treasury because nobody was watching, nothing would have stopped the transfer even if they had been, and the DAO apparently never stress-tested its own governance against exactly this scenario, despite it being a well-known attack pattern in DeFi at this point.