What is a governance attack? How BonkDAO lost $20M in a single vote

cryptonews07-07

On July 6, 2026, someone spent about four million dollars buying BONK, used it to control almost a hundred percent of a seven-wallet vote, and legally walked off with twenty million from the DAO’s ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2649936964?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-07-07 22:40","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2649936964","market":"sh","top_or_hot":-1,"title":"What is a governance attack? How BonkDAO lost $20M in a single vote","media":"cryptonews","content":"<div>\n<p>On July 6, 2026, someone spent about four million dollars buying BONK, used it to control almost a hundred percent of a seven-wallet vote, and legally walked off with twenty million from the DAO’s ...</p>\n\n<a href=\"https://crypto.news/what-is-a-governance-attack-how-bonkdao-lost-20m-in-a-single-vote/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>What is a governance attack? How BonkDAO lost $20M in a single vote</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nWhat is a governance attack? How BonkDAO lost $20M in a single vote\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-07-07 22:40 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/what-is-a-governance-attack-how-bonkdao-lost-20m-in-a-single-vote/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>On July 6, 2026, someone spent about four million dollars buying BONK, used it to control almost a hundred percent of a seven-wallet vote, and legally walked off with twenty million from the DAO’s ...</p>\n\n<a href=\"https://crypto.news/what-is-a-governance-attack-how-bonkdao-lost-20m-in-a-single-vote/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BK4506","symbol_name":"内地教育股","start_time":0,"source_url":"https://crypto.news/what-is-a-governance-attack-how-bonkdao-lost-20m-in-a-single-vote/","article_id":"2649936964","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/what-is-a-governance-attack-how-bonkdao-lost-20m-in-a-single-vote/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2649936964","pubTimestamp":1783435200,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"On July 6, 2026, someone spent about four million dollars buying BONK, used it to control almost a hundred percent of a seven-wallet vote, and legally walked off with twenty million from the DAO’s treasury. No code was hacked. The voting worked exactly as designed. Here is how governance attacks work, why they are getting more common, and what actually stops them.BonkDAO lost about $20 million after an attacker bought enough BONK tokens to dominate a governance vote without exploiting any code.Governance attacks allow attackers to use legitimate voting systems to approve malicious proposals when token ownership is concentrated and voter participation is low.Timelocks, quorum requirements, and emergency controls remain the main safeguards against governance attacks by making treasury takeovers harder to execute.Table of ContentsWhat a governance attack isThe BonkDAO case, step by stepThe main variantsA short history of governance attacksThe Tornado Cash case in 2023Why this is so hard t","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BK4506":"内地教育股","BK4204":"教育服务","TMF":"3倍做多20年期以上国债ETF-Direxion","TLTW":"iShares 20+ Year Treasury Bond Buywrite Strategy ETF","TLT":"20+年以上美国国债ETF-iShares","BK4510":"在线教育","DAO":"有道"},"translate_title":"什么是治理攻击？BonkDAO如何在一次投票中损失2000万美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"US7Y.BOND":0.9,"TMF":0.6,"US5Y.BOND":0.9,"US30Y.BOND":0.9,"TLT":0.6,"US3Y.BOND":0.9,"US12M.BOND":0.9,"DAO":0.9,"US10Y.BOND":0.9,"US6M.BOND":0.9,"TLTW":0.6,"US2Y.BOND":0.9},"content_text":"On July 6, 2026, someone spent about four million dollars buying BONK, used it to control almost a hundred percent of a seven-wallet vote, and legally walked off with twenty million from the DAO’s treasury. No code was hacked. The voting worked exactly as designed. Here is how governance attacks work, why they are getting more common, and what actually stops them.\n\n\nSummary\n\n\n\nBonkDAO lost about $20 million after an attacker bought enough BONK tokens to dominate a governance vote without exploiting any code.\nGovernance attacks allow attackers to use legitimate voting systems to approve malicious proposals when token ownership is concentrated and voter participation is low.\nTimelocks, quorum requirements, and emergency controls remain the main safeguards against governance attacks by making treasury takeovers harder to execute.\n\n\n\nTable of ContentsWhat a governance attack isThe BonkDAO case, step by stepThe main variantsA short history of governance attacksThe Tornado Cash case in 2023Why this is so hard to fixThe defenses that workFrequently asked questions\nMost crypto thefts break something: a smart-contract bug, a stolen key, a spoofed website. A governance attack breaks nothing. It uses a decentralized organization’s own voting system, exactly as intended, to pass a proposal that hands the attacker the treasury. The code performs flawlessly. The rules are followed to the letter. And the money leaves anyway, because the rules themselves allowed it.\nThat is what happened to BonkDAO on July 6, 2026. An attacker quietly bought roughly four million dollars of the BONK token on exchanges over several days, accumulated a dominant share of voting power, and submitted a proposal to the DAO’s treasury. When the vote closed, wallets linked to the attacker controlled about 99.878 percent of the votes cast, the proposal passed, and around twenty million dollars in BONK drained from the treasury to attacker-controlled wallets. Only seven addresses voted at all. There was no exploit in the usual sense; there was a takeover, executed through the front door.\nGovernance attacks are becoming more common precisely because they require no elite technical skill, only capital and a poorly defended voting system, and a growing number of DAOs, many of them memecoin projects with outsized treasuries, hold large treasuries behind exactly such systems. This guide explains what a governance attack is, walks through the BonkDAO case in detail, covers the main variants including the flash-loan version that needs no upfront capital at all, surveys the historical record from Beanstalk to Compound to Tornado Cash, and lays out the defenses that actually work along with the reasons they are so rarely fully deployed. The through-line is a single uncomfortable idea: in a system where money votes, whoever can rent enough votes can rewrite the rules, a vulnerability distinct from the code exploits and key compromises that drain cross-chain bridges.\nWhat a governance attack is\nA decentralized autonomous organization, or DAO, replaces executives and boards with token-holder voting. Holders of the governance token submit proposals, other holders vote, and if a proposal reaches the required threshold, a smart contract executes it automatically. Proposals can adjust parameters, upgrade code, or move treasury funds, and the appeal is that no single person controls the outcome; the community does, transparently and on-chain.\nA governance attack turns that openness into a weapon. Instead of finding a bug in the DAO’s code, the attacker acquires enough voting power through entirely legitimate means, usually by buying the governance token, and then uses that power to pass a proposal that benefits the attacker at everyone else’s expense, most often by transferring the treasury to themselves, a purely economic attack that needs no transaction-ordering exploit or mempool trickery. Because the acquisition of tokens and the casting of votes are both permitted actions, the attack is what security researchers call purely in-protocol: it cannot be prevented by cryptography or better code auditing, because nothing is being exploited except the voting mechanism working as designed.\nThis is what makes governance attacks conceptually different from every other crypto theft. A reentrancy bug or a stolen private key is a failure of implementation; the system did something it was not supposed to do. A governance attack is a failure of design; the system did exactly what it was supposed to do, and the outcome was still a robbery. Fixing it requires rethinking the rules of the vote, not patching a line of code, which is why these attacks keep succeeding against protocols whose smart contracts are flawless.\nThe root vulnerability is almost always token-weighted voting, the default model in which one token equals one vote. Token-weighted voting quietly assumes that large holders are aligned with the protocol’s success, because they have money at stake. That assumption fails completely against an attacker who does not care about the protocol’s future and only wants to control one vote long enough to drain the treasury. To that attacker, buying tokens is not an investment in the project; it is the purchase of a weapon, discarded the moment it has fired.\nThe BonkDAO case, step by step\nThe July 2026 BonkDAO attack is a near-perfect illustration, because it used no exploit at all and every step was visible on-chain.\nThe setup was patient accumulation. Over several days, the attacker bought roughly four million dollars of BONK using exchange wallets, building voting power gradually instead of in one conspicuous purchase. Because BonkDAO used ordinary token-weighted voting on a standard governance platform, that accumulated BONK translated directly into accumulated votes, and because the buying was spread out and routed through exchanges, it did not trigger alarm. To any observer, it looked like ordinary accumulation of a memecoin.\nThe execution was a proposal to the treasury. The attacker submitted a governance proposal and let it sit live for six days, the normal voting window. Here the fatal weakness showed: almost nobody else voted. When the window closed, only seven wallet addresses had participated, and wallets controlled by the attacker held about 99.878 percent of the total voting weight. The four-million-dollar token position was more than enough to dominate a vote that essentially no one else showed up for. The proposal passed, and the DAO’s smart contract did what passed proposals do: it executed, moving roughly twenty million dollars in BONK from the treasury to the attacker’s wallets.\nThree design failures converged. There was no meaningful quorum requirement, so a vote decided by seven wallets counted as legitimate. There was no timelock strong enough to let the community notice and react to an anomalous treasury proposal before it executed. And there was no emergency check, such as a multisignature control over large treasury movements, to catch a proposal that would drain the treasury. Any one of these, properly set, might have stopped the attack; their combined absence made a four-million-dollar purchase sufficient to steal twenty million.\nThe aftermath followed the now-familiar script. BonkDAO traced the exchange wallets used to accumulate the tokens and began working with exchanges, cross-chain bridges, the network’s foundation, and law enforcement to pursue recovery, while at least one exchange suspended BONK transfers. But governance-attack recoveries are notoriously hard, precisely because the theft was executed through the DAO’s own legitimate process, not an exploit that might be reversed, and the token’s price fell sharply on the news. The attack also did not stand alone: it landed in a stretch of DeFi security incidents that had the market on edge, underscoring how quickly value can leave when the weakest link is the governance layer instead of the code.\nThe main variants\nGovernance attacks share a logic but come in several forms, distinguished mainly by how the attacker acquires voting power and how quickly they strike.\nThe slow accumulation attack is the BonkDAO model: buy tokens gradually over days or weeks, avoid suspicion, and strike when you control enough votes and turnout is low. A patient attacker can go further, spreading purchases across many anonymous wallets so the accumulation looks like healthy, distributed participation instead of a single entity building a weapon. Low voter turnout is the enabling condition because it lowers the number of tokens needed to dominate; in a DAO where almost no one votes, a modest position can control outcomes.\nThe flash-loan attack is the most dramatic variant, because it requires no upfront capital at all. A flash loan lets a user borrow a very large sum with no collateral, provided the loan is repaid within the same transaction. An attacker borrows a huge amount, uses it to buy or otherwise acquire a controlling block of governance tokens, votes to pass a malicious proposal, extracts the treasury, and repays the loan, all atomically in a single transaction that either fully succeeds or fully reverts. Because everything happens in one block, there is no window for anyone to react. This variant is what makes timelocks so important, since a mandatory delay between a vote passing and its execution breaks the single-transaction requirement that flash-loan attacks depend on.\nOther paths to voting power exist. An attacker might exploit a flaw in how the protocol distributes or mints governance tokens, acquiring votes without paying market price. They might manipulate a price oracle to acquire tokens cheaply, exploiting a swap’s slippage and price impact to move a thin market in their favor. Or they might use a sybil strategy, splitting holdings across many accounts to appear as many independent voters while acting as one. What unites all variants is the goal: assemble enough voting weight, by whatever means, to pass a proposal the rest of the community would never approve, then convert that proposal into stolen funds before anyone can stop it.\nA short history of governance attacks\nThe BonkDAO attack was severe but far from the first, and the historical record shows both the pattern’s persistence and how defenses have evolved in response.\nThe Beanstalk attack in 2022 is the textbook flash-loan case. An attacker took an enormous flash loan, used it to acquire a supermajority of the stablecoin protocol’s governance tokens, passed a proposal that drained the treasury, and repaid the loan, all in a single transaction. The haul was well over a hundred million dollars, and the entire operation lasted one block. Beanstalk became the canonical example of why any governance system that lets freshly acquired tokens vote immediately, with no delay before execution, is dangerously exposed to flash loans.\nThe Compound episode in 2024 showed a subtler form. A group associated with a well-known whale pushed through a proposal directing tens of millions in the protocol’s tokens to a vehicle they controlled, after delegating enough tokens to meet quorum. The community was divided over whether to call it an attack or aggressive-but-legitimate governance, and the resolution came partly through the threat of centralized intervention and partly through negotiation, a reminder that many DAOs retain a centralized backstop precisely because pure token voting can produce capture. It also illustrated that governance attacks are not always anonymous outsiders; they can be sophisticated insiders exploiting low participation and misaligned incentives in plain sight, the same fragility that shadows liquid staking tokens when one provider dominates.\nThe Tornado Cash case in 2023\nThe Tornado Cash case in 2023 delivered a chilling twist: an attacker passed a malicious proposal that granted themselves a controlling number of votes, effectively seizing the entire governance system, then, after extracting value, used their captured power to reset the malicious changes. The privacy protocol’s governance briefly ceased to exist as a decentralized entity because one proposal handed one actor total control. Smaller cases, from Build Finance to various memecoin DAOs, repeat the pattern at lower stakes. The consistent lesson across all of them is that treasuries are only as safe as the voting rules guarding them, and that a flawless smart contract offers no protection when the vote itself is the attack surface.\nWhy this is so hard to fix\nIf the defenses are known, a fair question is why governance attacks keep succeeding. The answer is that every defense trades away something a DAO values, and the trade-offs are genuinely uncomfortable, which is why so many projects postpone them until an attack forces the issue.\nConsider the central tension. The entire premise of a DAO is open, permissionless participation: anyone can hold the token, anyone can propose, anyone can vote, and outcomes reflect the community instead of a gatekeeper. Every strong defense against governance attacks chips at exactly that openness. A high quorum requirement can paralyze a DAO whose members rarely vote, leaving it unable to pass even benign proposals. A long timelock slows the organization’s ability to respond to genuine emergencies, the very speed that on-chain governance was supposed to improve. An emergency multisignature or veto committee reintroduces a trusted group, which is a form of the centralization DAOs exist to escape. Each safeguard makes the DAO safer and less decentralized at the same time, and communities are understandably reluctant to give up the ideal that drew them together.\nLow participation compounds the problem and resists easy solution. Most DAOs suffer chronically low voter turnout, with studies finding that a large share have only a handful of active voters, and low turnout is the single condition that makes governance attacks cheap, because it lowers the token threshold an attacker must reach. Yet turnout cannot simply be mandated; it reflects the reality that most token holders are passive, hold for price rather than participation, and have little time or expertise to evaluate proposals. Delegation, where holders assign their votes to engaged representatives, helps, but it concentrates power in delegates and introduces its own capture risks. The passivity that enables attacks is a structural feature of token ownership, not a bug that a single mechanism can eliminate.\nThere is also the deeper problem that a token market cannot distinguish a supporter from an attacker. Both are simply buyers willing to pay for tokens, and from the market’s perspective they are indistinguishable right up until the malicious proposal executes. Token-weighted governance assumes economic alignment, that anyone holding many tokens must want the protocol to succeed, but an attacker who plans to drain the treasury and discard the tokens has no such alignment, and no purchase-time signal reveals the difference. This is why some researchers argue that token voting alone can never be fully secure and that durable solutions require non-token inputs, reputation, identity, or contribution history, that markets cannot simply buy. Those approaches are early and hard to implement without reintroducing gatekeepers. The uncomfortable conclusion is that governance security is not a solved problem with a checklist to apply, but a live design frontier where every fix costs some decentralization, and where the cheapest, most open configuration, the one many DAOs default to, is precisely the one attackers find most inviting.\nThe defenses that work\nBecause governance attacks exploit design, not code, the defenses are matters of mechanism design, and a well-configured DAO can make an attack unprofitable even if it cannot make it impossible.\nTimelocks are the single most important defense. A timelock imposes a mandatory delay between a proposal passing and its execution, and it does two things at once. It breaks flash-loan attacks entirely, because the borrowed tokens cannot be held across the delay, defeating the single-transaction requirement. And it gives the community a window to notice an anomalous proposal and respond before the treasury moves. The BonkDAO attack, with its six-day live window but apparently no effective execution delay or reaction, shows that a voting period is not the same as a timelock; what matters is a hard delay between approval and execution during which defenders can act.\nQuorum requirements raise the bar for legitimacy. A quorum sets a minimum amount of voting participation for a proposal to pass, so a vote decided by a handful of wallets does not count. Had BonkDAO required a substantial quorum, a seven-wallet vote would have failed regardless of how the attacker’s tokens were distributed. Related measures include conviction voting, where voting power builds the longer tokens are committed, penalizing the sudden accumulation that attacks rely on, and delegation systems that raise overall turnout, which mechanically increases the tokens an attacker must acquire.\nEmergency controls provide a last line. A multisignature control over large treasury movements, or a veto mechanism allowing trusted actors to pause or reject a clearly malicious proposal, can stop a drain even after a vote passes. These measures reduce decentralization, which is a real trade-off DAOs must weigh, but they exist precisely because pure token voting has repeatedly proven drainable. Many protocols keep a centralized safeguard for exactly the scenario Compound faced.\nFinally, limiting what governance can do shrinks the prize. If a single proposal cannot unilaterally move the entire treasury, and if large disbursements require additional steps or approvals, the value an attacker can extract falls, and with it the incentive to attack at all. The unifying principle across every defense is to make the cost of acquiring enough votes exceed the value that could be stolen, or to insert enough delay and friction that the community can intervene before the theft completes. A DAO that has done neither, holding a large treasury behind cheap, immediate, low-turnout token voting, is not running a governance system so much as an unlocked vault with a suggestion box. BonkDAO’s twenty-million-dollar lesson is that the suggestion box, in the wrong hands and with enough tokens behind it, opens the vault.\nThe wider context is that governance is becoming a bigger target as DAOs hold more value. Memecoin communities in particular have accumulated substantial treasuries, often denominated in volatile tokens whose value can swing sharply, while running the simplest possible voting systems, and the combination of a rich prize behind a weak lock is exactly what attackers seek. As on-chain governance spreads from experimental protocols to organizations managing serious money, the gap between DAOs that have hardened their voting and those that have not becomes one of the clearest dividing lines in crypto security. The attacks are not going away, because the incentive is structural and the cheapest configuration is the most vulnerable one. What changes, DAO by DAO, is whether the treasury sits behind defenses proportionate to its size, or behind a vote that four million dollars and an empty room can win.\nFrequently asked questions\n\n\n\nWhat is a governance attack?\n\nA governance attack is when someone acquires enough voting power in a DAO, usually by buying its governance token, and uses that power to pass a proposal that benefits them at the community’s expense, typically draining the treasury. It exploits the voting mechanism working as designed, not a bug in the code, which is what makes it different from a typical smart-contract hack.\n\n\n\nHow did the BonkDAO attack work?\n\nThe attacker spent roughly four million dollars buying BONK on exchanges over several days, accumulating dominant voting power. They submitted a treasury proposal that sat live for six days, and because only seven wallets voted, the attacker’s wallets controlled about 99.878 percent of the vote. The proposal passed, and roughly twenty million dollars in BONK drained from the treasury, with no smart-contract exploit involved.\n\n\n\nWas any code hacked in a governance attack?\n\nNo. In a governance attack, the smart contracts perform exactly as designed. The theft happens because the voting rules themselves allowed a malicious proposal to pass and execute. This is why governance attacks cannot be prevented by better code audits alone; they require changes to the voting mechanism, such as timelocks, quorums, and emergency controls.\n\n\n\nWhat is a flash-loan governance attack?\n\nIt is a variant that needs no upfront capital. The attacker borrows a large sum with no collateral, uses it to acquire a controlling block of governance tokens, passes a malicious proposal, drains the treasury, and repays the loan, all within a single transaction. The 2022 Beanstalk attack, which took over a hundred million dollars, is the canonical example, and timelocks are the main defense because they prevent execution within one transaction.\n\n\n\nWhy are governance attacks becoming more common?\n\nThey require capital and a weak voting system rather than elite technical skill, which lowers the barrier compared with finding code exploits. Many DAOs, especially memecoin projects, hold large treasuries behind simple token-weighted voting with low voter turnout, making them attractive targets. Accumulating enough tokens to control a low-turnout vote is often cheaper than the treasury it can capture.\n\n\n\nCan stolen funds from a governance attack be recovered?\n\nRecovery is difficult because the theft was executed through the DAO’s own legitimate process rather than an exploit that might be reversed. Projects typically trace the wallets, coordinate with exchanges, bridges, and law enforcement, and hope to freeze funds before they are laundered, but success is uncertain. BonkDAO began such efforts after its attack, with recovery unresolved.\n\n\n\nWhat defenses stop governance attacks?\n\nThe main defenses are timelocks that delay execution after a vote passes, quorum requirements that invalidate low-turnout votes, conviction voting that penalizes sudden token accumulation, emergency multisignature or veto controls over large treasury movements, and limits on what a single proposal can do. Together, they aim to make an attack cost more than it could steal or to give the community time to intervene.\n\n\n\nIs token-weighted voting the problem?\n\nToken-weighted voting is the core vulnerability because it assumes large holders are aligned with the protocol when in fact, an attacker can buy votes purely to drain the treasury. Alternatives and supplements like conviction voting, quorum floors, delegation to raise turnout, and non-token reputation systems all aim to weaken the assumption that whoever holds the most tokens should control the outcome.\n\n\n\n\nDisclaimer: This article is for informational purposes only and does not constitute investment advice. Digital asset markets are volatile, and you can lose your entire investment. Always do your own research. Information current as of July 7, 2026.\n\n\n\n\n\n                Read more:\n            \n\n                What are cross-chain bridges? Why they keep getting hacked","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.45.2","shortVersion":"4.45.2","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2649936964","isCrawlerRequest":true}