On-chain tracking exposed the attacker completely, from borrowing on marginfi to vote to depositing funds on the same exchange; DeFi's transparency truly becomes a double-edged sword at times like this.

CoinWorld News reported that on-chain analyst specter said that after conducting a preliminary investigation into the malicious governance proposal attack on bonkdao (about $20 million worth of BONK stolen), he found that the attacker allegedly created the malicious proposal on June 30 and obtained about $4 million in voting power between July 4 and July 5 through an exchange and marginfi lending, to meet the 1% voting threshold of BONK circulating supply. specter said that on July 6, the attacker cast yes votes using two wallets, with the main address holding approximately 8822 billion BONK, accounting for about 99.87% of the voting power. The two voting addresses were later found to be on-chain linked through the same exchange deposit address. specter further said that the related historical addresses had on-chain interactions with public wallets and DAO test proposals initiated by realmsdao founder deanmachine.