How Governance Attacks Exploit DAO Voting Power to Drain Treasuries

That gap creates a governance attack surface: an attacker may acquire enough voting power to pass a valid proposal and move treasury assets without exploiting a smart-contract bug. For DeFi protocols, the issue is not only code security. It is the concentration of control behind the voting process.

The attack can follow the rules

A governance attack does not necessarily break the protocol. The proposal can meet quorum or voting thresholds, pass through the established process, and execute exactly as designed.

The reported sequence is straightforward:

• acquire sufficient voting power;
• submit a proposal;
• vote it through;
• execute the approved transaction.

Voting power may be bought on the open market, temporarily obtained through a flash loan, or distributed across multiple wallets. That makes the attack harder to classify using controls built around code defects or abnormal transaction behavior.

A conventional audit checks whether the smart contract behaves differently from its intended design. Transaction monitoring looks for unusual fund movements. Governance attacks can satisfy both systems. The contract is functioning correctly, and the transfer occurs through an authorized path.

That distinction matters for treasury protection. A technically clean execution can still represent a hostile takeover of the protocol’s decision process.

BonkDAO shows the concentration problem

Digital Journal cites CoinDesk’s account of a July 2026 BonkDAO incident. An unidentified participant reportedly spent approximately $4.4 million acquiring BONK tokens before submitting a proposal that transferred about $20 million in treasury assets to a wallet under the participant’s control.

Only seven wallets participated in the vote, according to the report. Crypto Briefing reported that wallets associated with the participant represented approximately 99.878% of the voting weight. The proposal passed and was executed through the DAO’s governance system.

The numbers point to a basic control failure: formal decentralization can coexist with highly concentrated effective power. A large voter count on paper is not the same as distributed control if only a small number of wallets participate or if related wallets dominate the vote.

The exposure is not limited to token purchases. In April 2022, Beanstalk suffered a governance attack involving a flash loan. The Guardian reported that borrowed funds were used to obtain enough voting rights to approve a proposal, resulting in the removal of assets valued at more than $180 million at the time.

The mechanisms differed, but the systemic weakness was similar: voting power could be assembled quickly enough to control a decision with material treasury consequences.

What security teams should track

The reported incidents suggest that governance monitoring needs to sit alongside contract audits and transaction surveillance. The key indicators are not limited to the proposal payload.

Teams should examine:

• sudden changes in voting-power concentration;
• wallets that acquire or borrow voting power shortly before a vote;
• proposals affecting treasury assets;
• voting participation that is unusually low relative to the value at risk;
• groups of wallets whose voting behavior indicates common control.

This is a different monitoring problem from detecting a re-entrancy bug or an unauthorized transfer. The transaction may be authorized. The risk sits in who controls the authorization threshold and how quickly that control was assembled.

The sustainability verdict is direct: concentrated voting power is a structural governance risk, not a defect that a conventional smart-contract audit is guaranteed to identify. With DAO treasuries reported above $25 billion and participation often limited to 5%–15%, protocols that monitor code but not voting concentration leave a material part of the attack surface unmeasured.