Crypto's governance problem is back, with losses from malicious proposals climbing from $22 million to nearly $40 million in less than two months.
- Attackers have stolen or initially drained roughly $40 million through successful governance takeovers in 2026, according to The Coinformer's analysis of protocol disclosures, security firm reports and on-chain incident records.
- That would make 2026 the second-largest year for this narrow class of attack, behind only 2022, when Beanstalk, an Ethereum-based stablecoin protocol, lost roughly $181 million after an attacker borrowed enough voting power to approve a proposal draining its reserves.
Failed proposals, disputed but otherwise legitimate votes, compromised admin or multisig keys and conventional smart contract exploits were excluded.
For attacks involving artificially minted tokens, the analysis also avoids treating theoretical token values as cash losses when the attacker couldn't actually extract that amount.
$22 million became nearly $40 million
Blockaid, a blockchain security firm, counted at least seven governance takeovers between June 9 and Aug. 6 with roughly $22 million in combined losses.
- The largest was BonkDAO, where an attacker spent about $4.4 million acquiring enough voting power to approve a proposal transferring roughly $20 million from the treasury. Following that attack, Upbit, which once handled nearly half of BONK trading, dropped its support, The Coinformer reported.
- Another attacker turned a roughly $600 governance position at BarnBridge into a $776,600 theft.
Two attacks since then pushed the tally sharply higher. For instance, on Aug. 23, Term Finance, an Ethereum lending protocol, lost about $8.5 million after an attacker acquired control of its thinly held governance token and pushed through proposals that gave access to its vaults. The attacker reportedly spent less than $1,000 obtaining the decisive voting position.
Then came Neutron, where an attacker spent roughly $20,200 acquiring enough NTRN tokens to help pass Proposal 9 on Sept. 22, which handed administrative control over contracts used by Astroport and Drop to the attacker, who replaced their code and drained them.
- Security researchers initially put the combined damage at about $9.3 million to $9.4 million.
Adding those two incidents to Blockaid's earlier tally brings 2026's gross figure to roughly $39.8 million.
Some of the Neutron assets have since been recovered or contained, so the figure shouldn't be read as $39.8 million permanently lost. It measures the value security researchers attributed to successful drains when the incidents occurred, before later recoveries.
The vote is becoming the exploit
The pattern is also different from Beanstalk as its attacker used a roughly $1 billion flash loan to temporarily command the protocol's governance and drain its treasury in a single transaction. It became the textbook example of what happens when borrowed money can instantly become voting power.
Several of this year's attackers didn't need anything so elaborate.
- For instance, BonkDAO's attacker just bought the votes, while Term Finance's attacker appears to have done much the same for less than $1,000.
- On Neutron, roughly $20,000 worth of voting power helped unlock contracts holding millions.
In each case, the governance machinery largely did what it was designed to do. The attacker's advantage was that controlling the vote cost far less than controlling the assets behind it.
Under The Coinformer's methodology, successful malicious governance attacks remained below roughly $5 million in 2023 and below the 2026 tally in both 2024 and 2025. Futureswap, one of the few clear examples from 2025, lost an estimated $830,000 after an attacker used a flash loan to push through a malicious proposal.
CurioDAO apparently produced a misleading headline number in 2024. An attacker minted roughly $16 million worth of CGT tokens after exploiting its governance system, but Curio's own recovery report put direct liquidity pool losses at only about $180,000, illustrating why nominally minted tokens were excluded from the conservative comparison.
- So far, 2026 is nowhere near Beanstalk-era losses. But with at least nine successful governance takeovers already identified and nearly $40 million affected, it has broken sharply from the relatively quiet years that followed.