Attackers vote themselves $20 million in BONK cryptocurrency

The decentralized finance organization that oversees BONK cryptocurrency announced Monday that attackers had drained $20 million worth of coins from the project.

BonkDAO said in a social media post that it was the victim of a “malicious governance proposal,” or an attack in which holders of a large amount of BONK used that leverage to vote more coins into their wallets.

“During the investigation, BonkDAO identified the exchange wallets used to purchase BONK ahead of the proposal,” the organization said. Crypto news sites reported that the attackers gathered about $4 million of the coin in preparation. BonkDAO did not report a figure.

The organization said it notified law enforcement and “continues to work with relevant parties to recover funds and identify those responsible.” The South Korean cryptocurrency exchange Upbit said that it had temporarily suspended deposits and withdrawals of BONK.

The dog-themed memecoin is a project on the Solana blockchain. BonkDAO itself held about 15 percent of the total amount of available BONK, reports said.

As of Monday afternoon Eastern U.S. time, the price of BONK was down about 7 percent, with an overall market capitalization of about $400 million.

DAO stands for “decentralized autonomous organization,” a structure that allows community members (in this case, BONK holders) to weigh in on decisions about the future of projects. A famous exploitation of cryptocurrency governance occurred in 2022, when an attacker drained about $180 million in reserves from the Beanstalk platform.

Because it corrupts the voting process, a malicious governance proposal differs from better-known hacks that involve smart contracts, the protocols that automatically execute actions according to a platform’s internal rules. 

For several years, U.S. authorities have been investigating and prosecuting smart-contract cases, including a $54 million theft from Uranium Finance. In some cases, platforms are able to recover stolen assets. In December, the Federal Trade Commission ordered the platform Nomad to distribute $37.5 million in crypto recovered after a 2022 incident.