How could someone turn a capital of US$4 million into US$20 million from BONK?

Recently, the BONK community was shocked by a case showing that governance weaknesses can be more dangerous than technical hacks.
Someone bought about US$4 million worth of BONK tokens. The goal was not investment, but to gain enough voting power in BonkDAO.
After that, they submitted a proposal requesting the DAO to send approximately 4.4 trillion BONK (worth about US$20 million) to their wallet, citing reasons such as restructuring and ecosystem rebuilding.
The proposal was open for voting for 7 days. Unfortunately, almost no community members paid attention to the proposal's content. Since there was not enough opposition, the proposal eventually passed according to DAO rules.
Once voting ended, the system automatically executed the proposal and sent billions of BONK tokens to the specified address. With a capital of about US$4 million, the perpetrator managed to seize assets worth about US$20 million, generating a profit of around US$16 million.
This case did not happen because the BONK blockchain was hacked, but because the governance mechanism was exploited by someone who understood DAO rules and managed to acquire sufficient voting power.
The key lesson is that in the Web3 world, threats do not always come from hackers breaking into systems. Sometimes, the rules created by the community itself can become a loophole if not properly monitored.