On July 6, 2026, attacker purchased enough BONK to control ~99.88% of governance votes, then passed proposal BIP #76 to drain 4.43T BONK from treasury. Missing timelocks and 1% quorum threshold enabled the attack.

BonkDAO suffered a governance attack. The attacker spent ~$4M to buy BONK tokens for sufficient voting power and passed a malicious governance proposal (BIP-76) to transfer ~$20M BONK from the treasury to controlled wallets. No smart contract exploit; used the DAO's own voting system.