BonkDAO treasury drained of $20 million in governance attack An unsettling report: Attackers emptied approximately $20 million from the BonkDAO treasury using a “legitimate” governance process. ① The attacker spent roughly $4.4 million to acquire enough BONK tokens to meet the proposal threshold, then passed a proposal with 99.9% approval to transfer all treasury assets. From the perspective of on-chain governance rules, every step was technically “compliant.” ② What went wrong? Analysis at https://t.co/sIK6AcZGUa highlights: BonkDAO had extremely low voter turnout, no timelock period, and highly concentrated voting power—allowing a single participant to control the outcome. ③ My own take: This incident is more alarming than a smart contract vulnerability. While smart contract exploits can at least be mitigated through audits and formal verification, governance attacks exploit flaws in the rules themselves—you can’t audit human behavior. The impact on the Solana ecosystem goes beyond the $20 million loss—it exposes a widespread issue in DAO governance: low voter participation + no timelock = anyone can “buy” a governance outcome. All DAO participants should ask themselves: Does your governance mechanism include a timelock? Is voter participation sufficiently high? If the answer is no, your treasury may be far more vulnerable than you think. @solana @Solana_zh #BonkDAO #Solana #GovernanceSecurity #DAOAttack