Governance Takeovers: How $22M Was Drained and How to Stop Them

Executive Summary

Over roughly eight weeks this summer, a wave of governance takeovers hit at least seven protocols on three chains for combined losses of about $22 million. Attackers abused the control mechanisms of the protocols themselves, the votes that pass proposals and the keys that sign transactions, to mint tokens, drain treasuries, and hijack upgrade paths.

Three incidents capture the range of methods attackers used across the wave. Token of Power, an Aragon-based governance token on Ethereum, was minted into oblivion for $1.59 million after an attacker bought a majority of its tiny fixed supply. BonkDAO lost roughly $20 million on Solana to an attacker who spent about $4.4 million to simply buy the vote. And BarnBridge lost about $777,000 when a $600 governance position hijacked an upgrade path and swept years-old token approvals from roughly 50 wallets.

The same failures appear in every incident, with majorities that cost less than what they unlock, no delay between a proposal passing and executing, and governance wired directly to the most dangerous powers a protocol has, minting, treasury movement, and contract upgrades.

This post breaks down what happened, why these attacks keep working, and the layered defenses that stop them, including how Blockaid's Cosigner acts as an independent signing check so a malicious proposal can pass a vote and still fail to execute.

What Is a Governance Takeover?

Governance attacks target onchain organizations that run on token voting, DAOs and the protocols and treasuries they govern. In systems like these, token holders vote on privileged actions, and that voting process is exactly what the attacker exploits in a hostile takeover. Instead of breaking the code, they acquire enough voting power to pass a malicious proposal, so the organization approves the theft itself, and the protocol carries it out as if it were legitimate. In plain terms, it's like buying a majority of a company's shares to vote yourself into its bank account.

The damage comes from what the vote controls, because governance usually sits directly on top of a protocol's most powerful actions. A single winning vote can mint unlimited tokens, drain the treasury, or push through a hijacked upgrade that sweeps up token approvals users granted years ago.

The best-known example is Beanstalk Farms in April 2022, when an attacker used a flash loan (a large loan borrowed and repaid inside a single transaction) to briefly control a majority of the project's votes and pushed a malicious proposal through in that same transaction, leaving with roughly $182 million. Between June and early August 2026, Blockaid's threat intelligence tracked seven of these takeovers across three chains, and three incidents stand out.

Recent Incidents That Stood Out

1. Aragon "Token of Power": The Mint and Dump ($1.59M, June 9)

Token of Power (TOP) was an Aragon-based governance token on Ethereum with a fatal flaw, a total supply of only 16,384 tokens, which made a majority cheap to assemble. The attacker, funded through Tornado Cash, picked up just over half of it, then used Aragon's Voting app to create, pass, and execute a proposal in a single transaction with no timelock. That proposal minted 10 billion new TOP straight to the attacker, who dumped them into a Balancer V1 pool and walked away with 944.2 WETH, about $1.59 million.

The root cause was a governance misconfiguration, a tiny fixed supply combined with a create-vote-execute-in-one-shot flow. Blockaid's exploit detection caught the attack as it unfolded, and the team flagged TOP as compromised with alerts on Telegram and X.

2. BonkDAO: The Bought Vote ($20M, July 6)

The biggest loss of the wave was also the simplest, because the attacker bought the vote outright. BonkDAO's governance on Solana's Realms platform needed only 1% of supply to pass a proposal and had no delay between a proposal passing and executing. Around June 30, the attacker submitted a proposal dressed up as a reward for yes-voters, with a hidden instruction to move funds out of the treasury. They spent about $4.4 million buying BONK to clear the 1% bar, controlled almost every vote cast, and on July 6 the proposal executed instantly, draining roughly $20 million.

The BONK team later traced the exchange wallets used to buy in and began pursuing recovery. The lesson is hard to miss. A 1% threshold with no execution delay turns a treasury into something an attacker can simply outbid.

3. BarnBridge SMART Yield: The Approval Sweep ($777K, July 15)

BarnBridge is the most instructive of the three, because it cashed in on risk users had forgotten they were carrying. Voting power was almost free. The attacker locked about 32,000 BOND, roughly $600, and pushed through a proposal that looked like a routine proxy upgrade. Once it passed, they swapped the SMART Yield controller for a malicious contract they controlled.

The damage came from old approvals. Years earlier, users had granted the BarnBridge contracts permission to move their USDC, and those approvals were still live. By taking over the upgrade path, the attacker could pull against about 50 wallets' worth of approvals without any new signatures, taking roughly $776,600 across two sweeps minutes apart (02:39 and 02:47 UTC). Blockaid warned customers and the community via X and Telegram that these approvals were at risk before the drain was publicly confirmed. A $600 governance position turned into a theft of three-quarters of a million dollars.

While these three incidents were the headline losses, they were part of a wider run. Between June 9 and August 6, 2026, at least seven governance takeovers hit DAO tooling, memecoin treasuries, and DeFi protocols across Ethereum, Solana, and Base. The wave included Panther, where a passing vote reached the protocol's upgrade rights, and Unicly, where the attacker's voting power was flash-borrowed for a single block rather than held.

Why These Attacks Keep Working

Thresholds set too low - BonkDAO's 1% bar and TOP's 16,384-token supply let an attacker take control cheaply. Once a majority costs less than what it unlocks, an attack is just an arbitrage.
No timelock between passing and executing - BONK's instant execution and TOP's create-vote-execute-in-one-transaction flow gave no one a chance to react, not the community, not an emergency multisig, not a monitoring system. A timelock is what separates a proposal you can still cancel from a theft you can only investigate afterward.
Governance wired straight to dangerous powers - Mint authority for TOP, treasury transfers for BONK, upgrade rights for BarnBridge and Panther, all reachable from a single passing vote. The more a single proposal can do, the worse a takeover gets.
Voting power you can borrow or corner - When votes can be flash-borrowed for one block, as in the Unicly incident and Beanstalk before it, or are cheap and concentrated, the attacker doesn't even need to hold a real stake.
Old, unlimited approvals left lying around - BarnBridge shows the blast radius isn't limited to the treasury. A hijacked upgrade path can reach into every wallet still carrying an old approval to the protocol's contracts.
Proposals no one can read - "Reward yes-voters" and "routine upgrade" are cover stories. When voters and signers can't see that a proposal actually mints tokens or moves money, they approve it blind.

How to Prevent Governance Takeovers

Based on the pattern across these incidents, Blockaid recommends treating governance and signing as critical infrastructure and defending them in layers:

Raise the cost of a majority - Set quorum and proposal-deposit thresholds high enough that control can't be bought or borrowed cheaply.
Snapshot voting power - Count votes from a past block so flash-borrowed tokens carry no weight.
Put a real execution timelock in front of every privileged action - With an emergency cancel or pause behind it.
Keep the most dangerous powers behind extra controls - Minting, treasury movement, and contract upgrades should never be reachable from a single vote.
Tighten control of signers and admin roles - The multisig signers and admin keys that can move funds or upgrade code deserve the same scrutiny as the contracts they control.
Monitor for takeover signals - Watch for sudden vote concentration and unusual proposal payloads.
Get users to revoke stale approvals - Before someone else can use them.
Add an independent signing check - So a malicious transaction can't execute even after it passes the vote.

How Blockaid's Cosigner Blocks Malicious Proposals Before They Execute

Good parameters only go so far, because eventually a transaction has to be signed. Most protocols and institutions route their privileged actions through a signing setup, whether a self-custody multisig (Safe, Squads) or an MPC provider (Fireblocks, Fordefi, Utila), and that signing layer is where the last line of defense sits.

Cosigner joins that setup as an automated, independent signer. It simulates each transaction offchain, reads the raw payload rather than trusting a frontend or a proposal's description, and checks it against Blockaid's risk engine or the organization's own rules. If a transaction fails validation or touches a flagged address, Cosigner withholds its signature, so a bought vote or a disguised "routine upgrade" can pass the vote and still fail to execute.

Learn more about Blockaid's Cosigner →

Conclusion

None of this summer's takeovers required breaking code, because almost all of them came down to cheap majorities, missing timelocks, and loosely held keys, failures that left the most dangerous powers a protocol has one vote or one signature away from execution. The conditions that invited each attack were visible in public parameters before the wave began, and any protocol can audit its own thresholds, timelocks, and upgrade paths against them today. Governance and signing are infrastructure, and they deserve a defense to match.

The parameter fixes close most of the distance, and for everything that still reaches the signing layer, Blockaid's Cosigner provides the independent check, validating what every privileged action will actually do before it is signed, so a proposal that passes the vote can still fail at execution. For the protocols and institutions holding treasuries like the ones drained this summer, that protection can be in place before the next proposal goes up for a vote.

Request a Demo →

About Blockaid

Blockaid is the onchain security platform trusted by the largest companies operating in Web3. Built by veterans of elite intelligence and cybersecurity units, Blockaid provides end-to-end protection for financial institutions, protocols, and end users, combining direct wallet and dApp integrations with real-time monitoring, detection, and response across smart contracts, infrastructure, and externally owned accounts. Since 2025, Blockaid scanned over 6.3 billion transactions and blocked 585 million attacks. Blockaid is the security infrastructure behind Coinbase, MetaMask, Uniswap, Safe, and dozens of the most widely used platforms in the industry.

Learn more at blockaid.io, and follow us on Twitter and LinkedIn.