BonkDAO Governance Bypass Reported at $21.2m

The recurring shape

Our tracker already records Beanstalk, where an attacker borrowed a governance supermajority inside a single transaction and executed a proposal that emptied the protocol. The defence identified then was an execution timelock: a delay between a proposal passing and taking effect breaks any attack that depends on holding power atomically.

Four years later, governance paths without that delay are still being exploited.

What a holder can check

Governance configuration is public. For any protocol whose treasury you have exposure to, the checkable questions are whether a passing proposal executes immediately or after a delay, what quorum is required, and whether voting power can be acquired atomically. None of that requires trusting a claim.

Status

We have not opened a tracker record for this incident. The reported figure comes from a monthly aggregator rather than the affected party, and our methodology requires a primary document before a row exists. If BonkDAO publishes a post-mortem, a record follows.