Inside DeFi governance attacks and the risks of concentrated voting power

Opinions expressed by Digital Journal contributors are their own.

In some governance attacks, the underlying smart contract operates as designed: a proposal satisfies the required voting conditions, passes, and triggers a transaction under the protocol’s established rules. Rather than exploiting a conventional coding flaw, an attacker may obtain enough voting power to influence the process and authorize the movement of treasury assets.

Because this activity may not involve a code defect, it can fall outside the scope of a conventional smart-contract audit. The potential exposure is substantial. Forbes reported in April 2026 that more than 5,000 tracked decentralized autonomous organizations, or DAOs, collectively managed over $25 billion in treasury assets. The same report placed typical voter participation at between 5% and 15%. In July 2026, CoinDesk reported that a BonkDAO proposal supported by seven voting wallets resulted in approximately $20 million in assets being transferred from its treasury.

The exploit that executes correctly

Many crypto-security controls are designed to identify differences between a system’s intended operation and its actual behavior. Audits examine code for vulnerabilities, while transaction-monitoring systems look for unusual movements of funds.

A governance attack can present a different problem. A proposal may satisfy the protocol’s formal requirements, proceed through its established voting process, and execute as designed. Controls focused primarily on technical deviations may therefore be less likely to identify the activity.

The process generally involves acquiring voting power, submitting a proposal, voting, and allowing the approved proposal to execute. Depending on the governance model, voting weight may be purchased on the open market, temporarily obtained through a flash loan, or distributed among multiple wallets.

“We saw this firsthand when Binance Security helped prevent a $1.2 million governance attack on BrainTrust,” says Jimmy Su, Chief Security Officer at Binance.

Identifying a potential governance takeover before execution may require monitoring changes in voting-power concentration and examining proposals that could affect treasury assets. The amount held in DAO treasuries makes such monitoring a relevant consideration for protocol-security teams.

Forbes’ April 2026 analysis placed tracked DAO treasury assets above $25 billion. Separately, a 2026 ACM study of DAO governance examined how centralization and participation can affect decentralized governance systems.

A July 2026 governance vote

The July 2026 BonkDAO incident provides one example of how acquired voting power can affect a treasury proposal. According to CoinDesk, an unidentified participant spent approximately $4.4 million acquiring BONK tokens before submitting a proposal that transferred about $20 million in treasury assets to a wallet under the participant’s control.

CoinDesk reported that only seven wallets participated in the vote. Crypto Briefing reported that wallets associated with the participant accounted for approximately 99.878% of the voting weight. The proposal subsequently passed and was executed through the DAO’s governance system.

Other incidents have involved different mechanisms. In April 2022, Beanstalk experienced a governance attack involving a flash loan. The Guardian reported that borrowed funds were used to obtain sufficient voting rights to approve a proposal, resulting in the removal of assets valued at more than $180 million at the time.

These cases involved different methods and governance structures, but both illustrate how voting concentration and execution rules can affect the security of treasury-controlled protocols.

“Code is no longer necessarily the weakest link in Web3,” Su says. “As smart contract security improves, attackers are shifting their attention to the people, credentials and governance systems surrounding protocols.”

Low turnout is the multiplier

Research indicates that voting power and participation can be unevenly distributed across some DAOs, although the extent varies by organization and governance model. Forbes reported that fewer than 1% of token holders control approximately 90% of voting power across the DAOs included in the data it reviewed, while voter participation typically ranges from 5% to 15%.

Academic research also points to changes in token ownership around governance votes. A study by Stefan Kitzler and colleagues examined 8,116 proposals and found shifts in governance-token ownership shortly before voting in 1,202 cases, or 14.81%. The researchers described this figure as a lower-bound estimate.

Low turnout can reduce the amount of voting power required to influence an outcome. Participation may also remain limited when token holders are primarily interested in financial exposure rather than taking part in governance.

Token-weighted voting generally assumes that large holders have an economic interest in the protocol’s long-term performance. However, this model may be less effective when voting power is acquired temporarily or for the purpose of influencing a particular proposal.

“Protecting a protocol today means securing not just its code, but also who can control it, how that control is exercised, and the infrastructure and people behind it,” Su adds.

The trade-offs behind governance safeguards

Several governance controls can reduce particular forms of risk, although their effectiveness depends on how they are implemented. A delay between approval and execution can provide time to examine a proposal and may make certain flash-loan strategies more difficult. Quorum requirements can prevent proposals from passing without a minimum level of participation. Limits on individual treasury transactions may reduce the amount exposed through a single proposal, while an emergency-pause mechanism can allow authorized participants to review suspicious activity.

Governance mechanisms can also support responses to security incidents. In September 2025, a Venus Protocol user lost approximately $13.5 million after approving a malicious transaction during a phishing attack, according to DL News. The protocol paused operations and approved a governance proposal to liquidate the account used in the incident. Subsequent reporting stated that positions worth approximately $11.4 million were returned to the affected user.

These safeguards also involve trade-offs. Execution delays can slow approved transactions, quorum requirements can prevent proposals from proceeding when participation is limited, and emergency controls place additional authority in the hands of designated participants. Protocols must therefore weigh responsiveness, decentralization, and security when designing their governance processes.

Governance design as a security consideration

Governance design has become an important part of protocol security. Treasuries governed by inexpensive voting power, immediate execution, and low participation may face greater exposure to manipulation. Assessing voting concentration, participation requirements, and execution controls can therefore be as important as reviewing the underlying smart-contract code.