An anonymous wallet spent $4.4 million buying BONK tokens over two days, then used that stash to push through a governance vote that allowed it to drain $21.2 million from the BonkDAO treasury.

The incident, which saw the attacker walk away with a $16.8 million profit, has split the crypto community between those calling it a theft and those insisting the DAO did exactly what it was built to do.

How the Vote Went Through

According to blockchain analytics platform Lookonchain, preparations for the theft started on June 30 when the attacker filed a proposal asking BonkDAO to move 4.426 trillion BONK, worth about $21.2 million, to a wallet they controlled. To pass, the proposal had to be supported by at least 1% of the BONK supply, which, per data from CoinGecko, stands at just under 88 trillion tokens.

Then, from around July 4, they bought 882.285 billion BONK on Bybit and Binance, an amount that was just enough to clear the 1% requirement (879.95 billion) to make a quorum that could vote on the proposal they’d made at the end of June. They then proceeded to vote “yes” with all 882.285 billion BONK, passing the proposal, after which 4.426 trillion tokens were transferred to their wallet.

Another company that follows on-chain movements, Chainalysis, corroborated Lookonchain’s account of the incident, saying the attacker acquired their tokens between July 4 and 5, buying some from the mainstream exchanges and borrowing others through DeFi platforms.

About 9 hours after voting their way to the $21 million stash, Chainalysis says the attacker sent $188,000 to OKX (Peckshield puts that figure at $148,000) while putting the rest in a new DAO, “BONK 2.0,” that they created to govern the stolen funds. According to the analytics firm, the new DAO is controlled by the malicious voter, the exploiter wallet, and a third wallet said to have financial ties to the voter wallet.

BonkDAO confirmed the treasury loss in a statement posted on X, saying it had identified the exchange wallets that had been used to acquire the voting tokens before the proposal succeeded and that it had notified law enforcement while also coordinating with exchanges, bridges, and the Solana Foundation to “manage the situation.”

Following news of the theft, the BONK token lost some of its value, with CoinGecko showing it trading around $0.00000438 at the time of writing, a 7.4% drop in 24 hours but still up nearly 5% on the week.

A Working DAO or Fraud?

The event continues a streak reported recently by CryptoRank that has seen DeFi platforms lose nearly $1 billion to bad actors so far this year.

But not everyone agrees that a crime took place, including World Liberty Financial advisor Ogle, who questioned why law enforcement had become involved in what looked like a normal DAO function.

“Someone legitimately bought a lot of tokens, proposed a DAO vote, the vote passed with almost no opposition, and the proposal was executed,” they wrote on X.

The crypto maxi later added that reports claiming the voting website was inaccessible during the voting period, if true, would raise separate concerns but did not necessarily make the on-chain vote illegal.

However, others disagreed. Ripple CTO Emeritus David Schwartz argued that using voting control over a shared treasury for personal gain could amount to fraud because governance participants owe a fiduciary duty to other stakeholders. Further, he stated that BonkDAO’s lack of a formal legal wrapper could expose participants to partnership-style liabilities in some jurisdictions.

Source: CryptoPotato