Incident case file

BonkDAO Governance Attack — Malicious Proposal Treasury Drain

Incident date July 6, 2026

0 views

ActiveSolanaGovernance AttackCluster: BONKDAO-GOVERNANCE-2026-07

Estimated loss

$20M

Victims identified

Victim group joining is coming soon.

Investigation

75%

Facts and investigation

Attacker: 9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ (recipient of the treasury transfer). Transaction signer / operational wallet: 8xxRdtzsw1CJWfEahViqNjZwh5dYJAdSbBctWwcbycVo (funded via a Bybit deposit, independently active on Pump.fun).

Funds moved to: Confirmed on-chain transfer 5tPU1srcRcnmibB7KJi2WQ7cK4zuq5iKTMrSCLjq7hvGjuK4KUTmaHfwicixkJa5jZJmp3y98T7r2qecKV5mWw8P (block 431127240, 08:26:28 UTC July 6, 2026): 4,426,104,450,305.966 BONK moved from the BonkDAO treasury to the attacker's wallet via the Realms Governance Program. Approximately $148K-$188K subsequently traced to OKX (PeckShield/Lookonchain); the remainder was moved to a multisig described by Chainalysis as a shadow 'BONK 2.0' DAO. A secondary transfer occurred the same day aroun

Treasury source confirmed on-chain: AGkGWK1R669KDT4FCqgDgK7PgahGJPjD4J9xmVjuL9kn (labeled 'BonkDAO Wallet' on Solscan). The attacker spent approximately $4.4M on Bybit and Binance to acquire ~882.285B BONK, clearing the 879.95B quorum threshold by a narrow margin. Malicious governance proposal 'BIP-76 Sowellian BonkDAO' was submitted June 30, 2026 and passed on July 6 with only 7 wallets voting out of more than 18,000 DAO members (2.9% turnout).

Timeline: June 30, 2026: attacker submits governance proposal BIP-76 'Sowellian BonkDAO' on Realms. July 4-5, 2026: attacker accumulates approximately $4.4M worth of BONK via Bybit and Binance to secure a voting majority sufficient to clear quorum. July 6, 2026, 08:26:28 UTC (Solana block 431127240): proposal executes, transferring 4,426,104,450,305.966 BONK from the BonkDAO treasury (AGkGWK1R669KDT4FCqgDgK7PgahGJPjD4J9xmVjuL9kn) to the attacker's wallet (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ) via the Realms Governance Program, signed by an operational wallet funded via Bybit. Approximately 23:20 UTC the same day: partial transfer to a second wallet (suffix 'eh42', full address not recovered). Upbit and Kraken suspend BONK deposits and withdrawals. PeckShield and Lookonchain trace roughly $148K-$188K moved to OKX. No funds have been recovered as of this report; the bulk of the drained BONK remains parked in a multisig.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)