BonkDAO governance attack drains 4.426T BONK; attacker dumps 800B and still holds 2.4T

BonkDAO's treasury has been hit in what appears to be one of the year's largest governance-driven thefts, carried out without exploiting a smart-contract bug. An anonymous attacker is estimated to have siphoned about 4.426 trillion BONK by using the DAO's own voting process to approve a proposal that redirected treasury funds to a wallet under their control. The attacker reportedly built a voting position of roughly 882 billion BONK, spending about $4.4 million to do so. That stake was sufficient to clear BonkDAO's quorum requirement, enabling the attacker to submit and pass a malicious governance proposal. The transactions were executed on-chain through standard governance mechanisms, with no flash-loan scheme, reentrancy issue, or other technical vulnerability cited. The drained amount was valued around $20! million at the time. After the incident, BONK fell about 79%, trading near $0.00000383. The attacker has already sold 800 billion BONK for roughly $2 million and is believed to still control about 2.4 trillion tokens, leaving an overhang that could weigh on the market if further sales occur. Beyond BONK, the episode underscores a long-running weakness in token-weighted governance: when voting power scales directly with holdings, well-capitalized actors can gain temporary control and push through treasury-moving proposals. Common safeguards include voting timelocks, multisignature treasury approvals, and proposal thresholds that rise with the size of requested transfers$protections BonkDAO appears to have lacked in at least some form. For investors, the key near-term risk is the remaining 2.4 trillion BONK still sitting in the attacker's wallet. While the address can be monitored on-chain, visible selling often comes too late to prevent price damage. The incident also highlights the incentive mismatch: if a $4.4 million position can unlock roughly $20 million from a treasury, governance parameters become a primary security surface. Holders of DAO-governed tokens may want to review quorum settings, proposal timelocks, treasury access controls, and whether a multisig or veto backstop exists.