The wallets used in the $21 million BonkDAO governance attack did not begin their on-chain history with the proposal that emptied the DAO’s treasury. Public blockchain records reviewed by independent blockchain researcher Specter trace parts of the transaction history back to early 2023, intersecting with BONK governance activity, Solana protocols and exchange infrastructure years before the July 6 treasury transfer.
- A trader executes a $21.2 million treasury drain from BonkDAO by passing a malicious governance proposal on the Solana network.
- The attacker spent $4.4 million on Binance and Bybit to accumulate 882 billion BONK, exceeding the one percent quorum requirement.
- This incident proves that BonkDAO governance serves as a primary attack surface for hostile takeovers without requiring software or protocol exploits.
The historical records do not identify who controlled the wallets during the governance vote. Instead, they broaden the transaction graph investigators are examining as they reconstruct the wallets’ activity before they appeared in BonkDAO’s governance system.
The Investigation Began After the Treasury Transfer
The attack itself has already been reconstructed through on-chain records.
On June 30, a proposal titled “Sowellian BonkDAO” (BIP-76) was submitted through Solana’s Realms governance platform. The proposal instructed BonkDAO to transfer 4,426,104,450,305 BONK, worth about $21 million at the time, to wallet 9bxW…JHvQ.
According to public blockchain records, wallets accumulated approximately 882 billion BONK over July 4 and 5, narrowly exceeding the DAO’s quorum requirement before voting in favor of the proposal on July 6. Once the proposal passed, the transfer executed automatically under BonkDAO’s governance rules.
Have a development worth tracking?
Share product launches, funding announcements, partnerships, research findings and market developments with The Grey Terminal's readership.
→ Submit a Press ReleaseHours later, Specter began tracing the wallets beyond the proposal itself. “A quick investigation into the Bonk governance attack found something interesting,” the researcher wrote on X before publishing a reconstruction of the wallets’ historical activity.
Based on Specter’s analysis, the proposal relied primarily on wallet CyEE7o…, which cast approximately 882.2 billion BONK, representing nearly all of the affirmative votes. A second wallet, FQnQYa…, contributed roughly 97.8 million BONK.
Shared Exchange Deposits Reveal Earlier Activity
Rather than stopping at the governance vote, Specter’s investigation followed the movement of funds after execution.
Analysis by the investigator revealed both voting wallets later transferred assets through the same cryptocurrency exchange deposit address. Tracing that address backward uncovered earlier transactions involving wallet 5zvDd3… and a publicly identified wallet belonging to crypto_notte, founder of Solana derivatives protocol Vyper Protocol.
The historical records include repeated deposits into the same exchange infrastructure between late 2022 and early 2024. Specter also identified a January 2024 transaction in which crypto_notte’s public wallet transferred 0.69 SOL to wallet 5zvDd3….
The blockchain transactions establish historical interactions among the wallets. They do not establish who controlled the addresses used in the BonkDAO governance proposal.
Earlier Realms Activity Appears in the Wallet Graph
The historical transaction graph also reaches back to one of the earliest public demonstrations of Solana’s Realms governance platform.
In January 2023, Dean Machine, founder of Realms, published a test proposal inviting users to vote with BONK tokens. The first participant would receive one DEANS token.
According to Specter’s reconstruction, wallet 5zvDd3… cast the first vote before receiving the token reward from Dean Machine. Dean later referenced the transaction publicly on X.
The activity predates the BonkDAO governance attack by more than three years and forms part of the broader wallet history identified during the investigation.
Vyper Transactions Add Another Historical Intersection
Specter’s analysis also identified historical activity involving Vyper Protocol.
According to the investigation, wallet 5zvDd3… interacted with Vyper’s over-the-counter program about 97 minutes before the protocol publicly announced a BONK prediction market on Jan. 4, 2023.
Specter described the timing as “interesting,” noting additional historical exposure between the wallet and Vyper-related activity.
The analysis does not conclude that the transaction indicates prior knowledge of the announcement or connects Vyper Protocol to the BonkDAO governance proposal.
Most of the Treasury Remains Visible On-Chain
The movement of the treasury remains publicly traceable.
Blockchain records show the proposal transferred 4.426 trillion BONK from BonkDAO’s treasury to wallet 9bxW…JHvQ before most of the balance was later moved to another wallet ending eh42.
According to blockchain analytics account Lookonchain, approximately 40 billion BONK, valued at roughly $188,000, has since been deposited to cryptocurrency exchange OKX, while the remaining balance, about 4.386 trillion BONK, remains visible in the receiving wallet.
BonkDAO has described the incident as a malicious governance proposal and said it has notified law enforcement while working with exchanges, bridge operators and the Solana Foundation to recover the assets and identify those responsible.
Grey Terminal Note
Blockchain investigations rarely begin with a name. They begin with transactions. Every governance vote, token transfer and exchange deposit becomes another point in a public ledger that investigators can revisit years later. The BonkDAO investigation illustrates both the strength and the limits of that transparency: blockchain records can reconstruct relationships between wallets over time, but they cannot, on their own, identify the person controlling an address or establish intent.
Activate Terminal Layer
Structural analysis of the systems, pressures, and stakeholders behind this story.
