Someone just walked into BonkDAO, spent roughly $4.4 million on tokens, and walked out with approximately $20 million from the treasury. Not by hacking smart contracts. Not by finding a zero-day exploit. By simply showing up to vote when nobody else did.
Welcome to the era of the “apathy attack,” a term coined by Dr. NickA (Nick Almond), Head of Governance at Jito Foundation, to describe a governance exploit pattern that has now hit DAOs from Compound to BonkDAO. The vulnerability isn’t in the code. It’s in the community.
How the BonkDAO attack unfolded
On July 6, 2026, an attacker acquired enough BONK tokens to surpass the DAO’s 1% quorum requirement. Only about 2.9% of total participants actively voted on the malicious proposal, spread across just 7 wallets. The proposal passed and drained roughly 4.43 trillion BONK tokens, valued at approximately $20 million, from the treasury.
Post-attack, the stolen tokens were reportedly moved into a newly established “BONK 2.0” multisig DAO controlled by the attacker and their associates.
The irony is thick: BonkDAO specifically set its quorum at 1% as a measure to deter apathy by making governance participation easy. Instead, the low threshold made governance capture trivially cheap.
Compound’s earlier warning shot
Compound, one of DeFi’s most established lending protocols, faced its own governance crisis back in July 2024. Declining voter participation created the conditions for a similar exploit pattern, where proposals could be pushed through without meaningful community consensus. The incident was serious enough that Compound established the Compound Governance Working Group specifically to boost engagement and prevent future attacks.
Dr. NickA has drawn a direct line between these incidents, framing them as part of the same systemic vulnerability. The attack vector doesn’t target code. It targets disengagement. Historical data on DAO voter participation paints a grim picture. Turnout across token-weighted DAOs can dip below 10%, and in some cases falls as low as 0.1% to 3%.
The governance paradox
The BonkDAO attack is especially instructive because the $4.4 million spent to acquire tokens yielded roughly $20 million in stolen assets. That’s nearly a 5x return on a governance exploit.
Some protocols have experimented with alternative models. Quadratic voting, conviction voting, and delegate systems all attempt to solve different aspects of the participation problem. But none have achieved widespread adoption, and the dominant model remains one-token-one-vote with fixed quorum thresholds.
What this means for investors
Traders and investors evaluating DAO-governed protocols should be paying close attention to governance participation metrics. A protocol with consistently low voter turnout and a large treasury is essentially advertising its vulnerability. The ratio of treasury size to quorum cost becomes a rough measure of exploit profitability.
The emergence of “BONK 2.0” as an attacker-controlled entity adds another wrinkle. If stolen governance tokens can be reorganized into new structures that claim legitimacy, the attack doesn’t just drain a treasury. It fragments a community. Recovery becomes a legal, social, and technical challenge all at once.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
