Solana's most recognized memecoin community woke up to a serious problem on July 6. BonkDAO confirmed through its official X account that a governance attack had drained an estimated $20 mill
Solana's most recognized memecoin community woke up to a serious problem on July 6. BonkDAO confirmed through its official X account that a governance attack had drained an estimated $20 million worth of BONK tokens from the protocol's treasury — the first major security incident in the project's history since its December 2022 launch.
The mechanics were straightforward and damaging. An attacker exploited BonkDAO's proposal system to push through a fraudulent governance proposal, authorizing a treasury withdrawal. Once the transaction was approved on-chain, there was no reversing it. The stolen BONK began moving toward exchanges immediately, where it could be converted into other assets before any coordinated response was possible.
How the Attack Played Out
Governance attacks of this type exploit a vulnerability that exists in almost every DAO structure — the proposal and voting mechanism itself. Rather than cracking smart contract code, the attacker worked within the system's own rules, submitting a proposal designed to authorize fund access and seeing it through to execution. The specifics of how the fraudulent proposal cleared the protocol's approval thresholds haven't been fully disclosed, but the outcome was unambiguous: an on-chain transaction approved by the governance system drained a significant portion of the treasury.
Once the stolen tokens hit exchange wallets, they created immediate sell pressure. A stolen asset moving toward a liquid market in large size rarely produces orderly price action — and BONK's response confirmed that. The token fell more than 9% on July 6 as the attacker's wallets pushed supply onto exchanges without any buyer-side activity large enough to absorb the volume.
Upbit Suspends BONK Deposits and Withdrawals
South Korean exchange Upbit posted a notice on July 6 confirming it had temporarily suspended all BONK deposits and withdrawals in response to the incident. No timeline was given for when access would be restored. The suspension is a standard precautionary measure — exchanges typically halt a token's deposit and withdrawal functionality when large volumes of potentially stolen funds are known to be circulating toward their wallets, both to protect users and to comply with any law enforcement requests that may follow.
For BONK holders using Upbit as their primary venue, the suspension adds an operational headache on top of the price decline — an inability to exit, hedge, or add to positions through that platform until normal service resumes.
Where Recovery Efforts Stand
BonkDAO confirmed it has notified law enforcement and is working with relevant parties to identify the attacker and recover the stolen funds. No specific details were offered on the progress of that process, which is typical at this stage — public disclosures during active investigations tend to be limited to avoid interfering with recovery efforts or alerting the attacker to specific tracing activity.
The reality of governance attack recoveries in crypto is sobering. When stolen funds move to exchanges quickly and are converted into other assets, the trail fragments rapidly. Recovery depends heavily on exchange cooperation in freezing accounts, on-chain analytics firms tracing wallet flows, and law enforcement moving faster than the attacker can launder the proceeds.
BONK launched in December 2022 through one of the more memorable community airdrops in Solana's history, distributing tokens broadly to Solana NFT holders and developers at a time when the broader crypto market was reeling from the FTX collapse. It subsequently built genuine trading volume, secured exchange listings across major platforms, and was included in several crypto ETFs — a trajectory that made it one of the more legitimate memecoin projects in the space.
The July 6 attack doesn't erase that history. But it exposes a governance infrastructure gap that the community will now need to address directly — because a treasury that can be drained through a fraudulent proposal is a structural risk that persists until the mechanism is redesigned.
