A crypto treasury can look decentralized right up until someone buys enough votes to take it.

CoinDesk reported that a BONK-linked group faced a roughly $20 million treasury drain after an attacker spent about $4 million to pass a malicious governance proposal. According to the report, the proposal sent the group's holdings to a wallet controlled by the attacker, who then began selling.

The details matter for that specific project, but the broader lesson is bigger than one token. Governance is not magic. It is a system with incentives, turnout problems, rules, and attack surfaces.

Why token voting can break

Token governance often sounds democratic: holders vote, the protocol follows the vote, and the treasury moves according to the rules. In practice, a vote can be shaped by concentration, low participation, borrowed or newly purchased voting power, confusing proposals, and rushed review.

That does not mean every DAO is broken. It means investors should not treat "community governed" as the same thing as "safe." If a treasury can be moved by a vote, the quality of the voting process matters as much as the assets inside the treasury.

The SEC's Investor.gov crypto assets page tells investors to review custody, scams, and crypto-specific risks before investing. Governance risk belongs on that same checklist.

What ordinary holders should watch

The first question is simple: who can move the money? After that, read the proposal process. Look for quorum rules, voting delays, emergency controls, multisig requirements, delegation, conflict disclosures, and whether large holders can push through changes while everyone else is asleep.

There is a market angle too. If an attacker wins control of treasury assets and sells them, holders can get hit twice: first by the loss of project assets, then by price pressure from the sale. Even people who never voted can end up paying for a bad governance design.

For broader crypto-risk reading, see Daily Money Radar's guides on why Bitcoin prices move and crypto sanctions and exchange risk. Different issues, same basic habit: ask where the control points are.

The useful takeaway

A treasury is only as secure as the rules around it. Token voting can coordinate a community, but it can also create a target. If a proposal can move millions of dollars, the process deserves the same scrutiny as a smart contract audit.

This article is educational only and is not personalized investment, tax, legal, or financial advice. Do not treat governance labels as protection. Read the rules before you trust the treasury.

Sources and further reading