Specter said the suspected attacker used a malicious proposal, exchange purchases and roughly $4 million in marginfi borrowing to secure voting power over July 4-5, 2026.
A preliminary investigation into the BONK DAO governance attack identified notable on-chain links involving Realms' founder and Crypto Notte, both of whom had fund exposure to addresses tied to the suspected attacker, Specter said. The suspected attacker allegedly created a malicious proposal on June 30, 2026, then amassed the voting power needed on July 4-5 through exchange purchases and roughly $4 million borrowed from marginfi, a Solana lending protocol. The findings point to how governance systems can be manipulated when an actor rapidly acquires enough tokens or delegated influence to push through a proposal.