Loading story…
BonkDAO said attackers used a malicious governance proposal to drain about $20 million in BONK tokens from its treasury, in what appears to be a governance-takeover attack rather than a smart-contract exploit. The organization said the perpetrators accumulated a large BONK position in advance, then used that voting power to approve a proposal that minted or transferred additional tokens to wallets under their control, affecting the BONK ecosystem on Solana and contributing to an approximately 7% price drop after disclosure.
BonkDAO said it identified exchange wallets allegedly used to acquire BONK before the proposal and has notified law enforcement while coordinating with exchanges, bridges, and the Solana Foundation to trace and recover funds. South Korean exchange Upbit temporarily suspended BONK deposits and withdrawals following the incident, while BonkDAO had not yet publicly identified a suspect or disclosed the precise governance mechanism, on-chain transaction hashes, or independent confirmation of the theft.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
After draining BonkDAO's treasury, the attacker moved most of the stolen BONK into a multisig tied to a newly created shadow DAO dubbed 'BONK 2.0,' according to Chainalysis. The report also said the attacker sent about $188,000 to an exchange and began liquidating roughly $5.3 million in BONK used to secure voting power, while about $19 million remained in the new multisig.
Following the incident, South Korean exchange Upbit temporarily halted BONK deposits and withdrawals.
After identifying wallets tied to BONK purchases before the proposal, BonkDAO said it notified law enforcement and began coordinating with exchanges, bridges, and the Solana Foundation to recover funds and identify the perpetrators.
BonkDAO disclosed that attackers used a malicious governance proposal to mint or transfer roughly $20 million in BONK tokens to wallets they controlled. The organization said the incident was a governance-takeover style attack rather than a smart-contract vulnerability.
BonkDAO said the attackers built a large BONK position in advance, allegedly using identified exchange wallets to pre-position for influence over a governance vote.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
thedefiant.io
Open sourcetherecord.media
Open sourcethedefiant.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean cryptocurrency exchange Upbit suffered a major security breach resulting in the theft of approximately $30 million in digital assets from its Solana wallet. The attack exploited a vulnerability that allowed private key inferencing, enabling the attackers to transfer various tokens, including official Trump, USD Coin, and Bonk, out of Upbit's wallets. Following the incident, Upbit halted all digital asset transactions, initiated a comprehensive security review, and began restructuring its wallet systems. The company has assured customers that all losses will be covered and that the private key vulnerability has been addressed. South Korean officials and multiple sources have attributed the attack to the North Korean state-backed Lazarus Group, citing similarities in tactics and laundering methods to previous incidents, including a 2019 breach of Upbit. Investigators believe the hackers impersonated Upbit administrators to facilitate the theft and are actively tracking the stolen funds, attempting to freeze assets before they can be moved further. The breach occurred shortly after Naver's $10 billion acquisition of Dunamu, Upbit's parent company, adding further scrutiny to the incident. Authorities continue to investigate, emphasizing the ongoing threat posed by Lazarus to the cryptocurrency sector.
Jun 29, 2026
**Step Finance**, a Solana-based DeFi platform and analytics dashboard, reported a breach in which attackers **compromised devices belonging to company executives** and used that access to drain multiple **treasury wallets**. The incident was detected on **January 31**, with the threat actor described as leveraging a **“well-known attack vector,”** though Step Finance did not publicly disclose the specific technique or attribution. Initial third-party estimates from blockchain analytics firm **CertiK** put the theft at **261,854 SOL (~$28.9M)**, but Step Finance’s internal investigation later assessed total losses at **~$40M**. Step Finance said it has recovered **~$3.7M in Remora assets** and **~$1M in other positions** through partner coordination and **Token22 protections**, temporarily halted some operations to reinforce security, and stated that **Remora Markets is isolated** from the incident with **rTokens remaining 1:1 backed**; users were also advised **not to engage with the `STEP` token** until the investigation concludes.
Jun 29, 2026
Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about **$280 million to $285 million** after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s **durable nonce** feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called **CarbonVote Token (`CVT`)**, and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into **USDC** and **SOL**, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.
Jul 1, 2026