Governance Attacks Industrialized in 2026. So Did the Defense.

On 2 September 2026, an attacker did not break a single line of Yam Finance’s code. They delegated about 504,000 YAM to themselves, roughly 3.3% of the token’s supply and just enough to clear quorum, then filed proposal number 45 with a blank description. The proposal did one thing: it aimed the protocol’s Timelock at an address the attacker controlled, a step that would have handed over administrative control of the contracts guarding roughly $337,000 in assets. What makes the episode a marker for the year is not the size of the target. It is that the vote was flagged while it was still pending, well before it could clear, by an automated monitor called Defimon that watches DAO proposals for exactly this shape and urged holders to vote it down before the deadline block. (crypto.news)

That is the shape of governance attacks in 2026. The technique, using a project’s own voting rules to move a project’s own money, stopped being a novelty and became a production line. Between 9 June and 6 August, the security firm Blockaid counted at least seven governance takeovers that drained around $22 million across Ethereum, Solana, and Base. (Blockaid) But the same year that turned the attack into a repeatable business also handed the defense its first real instruments: on-chain monitors that catch a hostile vote before it executes, threat feeds that fingerprint the payload, and exchanges that freeze the attacker’s exit. This is a look at both sides of that arms race: what the playbook looks like now, why the classic defenses keep failing, and how to tell whether a protocol you hold is built to catch a vote-borne attack or merely to hope one never arrives.

The vote is the exploit, not the bug

A governance attack does not exploit a flaw in a smart contract. It exploits the contract doing exactly what it was written to do. In a token-voting DAO, whoever controls enough votes controls the treasury, the upgrade keys, and the risk parameters. Buy the votes, pass the proposal, move the funds; the software validates every step, because every step is legal. That is why an audit rarely helps. An audit asks whether the code behaves as specified, and in a governance attack it does, right up to the moment it signs away the vault. Security firms PeckShield and CertiK made the point bluntly after the summer’s largest case, noting the attacker had “targeted the voting mechanics rather than any flaw in the underlying smart contract code.” (CryptoBriefing)

The mental model most holders carry, a hooded coder finding a reentrancy bug at three in the morning, does not fit here. Nothing is stolen in the technical sense; a majority is assembled and a decision is made. The closest offline analogy is a corporate raider buying a controlling stake and voting to sell the company for parts, except the shares can be rented by the hour and the board meeting settles in a single block. The barrier to entry is not skill. It is capital, and in 2026 the capital required kept falling. The category’s landmark, Beanstalk’s $182 million flash-loan vote in April 2022, was treated at the time as a freak event that required borrowing more than a billion dollars for a few seconds. (Cointelegraph) Four years later the same idea gets executed against smaller targets for a few thousand dollars, over and over.

The summer the attack became a production line

Governance attacks used to arrive one at a time, spaced months apart, each treated as a curiosity. This year they clustered. Blockaid’s tally of the window from June to August names Token of Power, an Ethereum project whose entire supply was 16,384 tokens; an attacker bought a majority, then passed a single proposal, with no timelock in the way, that minted ten billion new tokens and walked off with about $1.59 million. (Blockaid) On Solana, BonkDAO lost around $20 million on 6 July after someone spent roughly $4.4 million to clear a 1% voting threshold and executed instantly. (crypto.news) BarnBridge’s SMART Yield product lost about $777,000 on 15 July when a governance position worth a few hundred dollars was used to hijack an upgrade path and sweep years-old token approvals from around fifty wallets. Two more, Panther and Unicly, rounded out the set, one seizing upgrade rights through a passing vote, the other borrowing voting power through a flash loan for a single block.

Then the wave kept building past Blockaid’s cutoff. On 6 August, the dormant node-service project StrongBlock lost about $72,000 when an attacker took over its abandoned governance and rewrote the Governor contract. (coinpaper) On 23 August, Term Finance lost $8.5 million, the summer’s biggest, despite defenses that on paper should have stopped it. And on 2 September, the Yam Finance attempt showed the pattern was still running into the autumn. The through-line is monotonous by design: a cheap or thinly held token, a quiet voter base, and one proposal that does something the community would never approve if it were paying attention.

The math that keeps it profitable

In 2022, the venture firm a16z published the paper that still frames this whole category. Its core is an equation any attacker can run on a napkin: profit equals the value you can extract, minus the cost of acquiring the votes, minus the cost of executing the attack. (a16z crypto) When a token trades cheaply relative to the treasury it governs, that arithmetic turns positive, and the attacker does not need to be clever, only solvent. The paper’s sharpest observation is what it calls indistinguishability: on the way in, an attacker buying up governance tokens looks identical to a bullish investor. Both bid aggressively, both accumulate, and the market cannot tell them apart until the malicious proposal lands. There is no signature to block, because buying tokens is the entire point of a token.

Two conditions make the math work almost everywhere, and both have gotten worse. The first is thin float: many governance tokens trade with shallow order books, so a determined buyer can corner a majority without moving the price enough to raise alarms. The second is apathy. Turnout in most DAOs sits in the single digits, so quorum is a low bar and a handful of wallets can carry a vote. The attacker is not fighting the community; the community is mostly not in the room. This is the same value-extraction logic that drives MEV on the open market, only here the profit is not skimmed from a pending transaction, it is voted out of a treasury in plain sight.

The zombie-DAO problem

The StrongBlock case is worth pausing on, because it is the purest illustration of a growing soft target: the abandoned DAO. StrongBlock was a node-as-a-service project whose activity faded long ago, taking the value of its STRONG token down with it. But the governance system never turned off. The Governor contract still held authority, and as the token’s price fell, the cost of buying a controlling stake fell with it, while the assets that authority could reach did not. (coinpaper) The attacker accumulated a majority, passed a proposal directing the Governor’s upgrader to name them pending admin, then, once in control, swapped in a malicious contract with a generic forwarding function that let them execute arbitrary transactions using the Governor’s authority. About 32,695 STRONG and 383,447 STRNGR, worth roughly $72,000, walked out.

The monitoring firm Defimon, which caught the attempt, was precise about what happened: the attacker “did not need to bypass the protocol’s access controls” and “used StrongBlock’s governance rules exactly as they were designed.” (coinpaper) That is the zombie-DAO threat in one line. Thousands of projects launched a token, wired it to a Governor and a treasury, and then drifted into irrelevance without ever revoking those powers. Each one is a loaded contract sitting in the open, its combination lock cheaper to buy every month the token bleeds. Call it governance debt: the liability a project leaves behind when it walks away from the machine but leaves it plugged in and armed.

When the timelock is not enough

If StrongBlock shows the easy target, Term Finance shows the hard one falling anyway. Term was not a ghost. It ran on battle-tested Yearn V3 vault infrastructure, and its governance carried the textbook defenses: a seven-day timelock, veto rights for liquidity providers, and a separation between the manager and governor roles. On 23 August it still lost about $8.5 million, roughly 68% of the assets in its Meta Vaults, when an attacker cornered its sparsely held governance token and passed proposals to seize the strategies. (The Block) Yearn noted the hole was in Term’s custom governance wrapper, not the standard vault code, and PeckShield and CertiK agreed the vault contracts were never the weak point.

The lesson is that a timelock is only as good as the hand hovering over the veto. Vitalik Buterin made the point years ago, and it reads like a caption for the Term post-mortem: “timelocks are more like a paywall on a newspaper website than they are like a lock and key.” (vitalik.eth.limo) A seven-day delay does nothing on its own; it only buys time for someone empowered and awake to cancel the malicious proposal. At Term, the veto existed and no one pulled it in time. The defenses were real, but they sat on the design layer, and the attack was won on the response layer, where nobody was standing. Term Labs later recovered its fixed-rate lending positions by moving them to upgraded contracts, but the drained 2,843 ETH and 1.68 million in stablecoins were gone, laundered out through a mixer, and the Meta Vaults were shut for good. (crypto.news) Recovery, as ever, is partial and slow, a pattern we traced across the industry’s post-incident recovery race.

The defense went live

Here is what actually changed in 2026. For most of DeFi’s history, governance security meant design: choose your timelock length, set your quorum, hope. The attacks this summer forced a second discipline into existence, one borrowed from network security: live monitoring. Firms now run bots that watch governance contracts the way an intrusion-detection system watches a network, looking not for a code bug but for the signature of a hostile vote. Blockaid says it caught the Token of Power mint in real time, flagging the transaction before it settled by spotting two tells at once, a sudden concentration of voting power and an unusual proposal payload, then simulating the transaction and scoring its risk before execution. (Blockaid)

The clearest example is Defimon, the monitor operated by the security firm Decurity, which has become something of a first responder for this attack class. It flagged Term Finance, it flagged StrongBlock, and it flagged the Yam Finance attempt on 2 September, in each case reading the proposal’s payload and raising an alarm before execution. On Yam, Defimon spelled out the exact kill chain to holders: the attacker “would first obtain pending administrator status over the Timelock,” and the address “could then call acceptAdmin to complete the transfer of administrative control.” (crypto.news) The payloads themselves are often the tell. A blank proposal description, a call to setPendingAdmin, a mint function pointed at an unknown address: to a human skimming a forum these look like noise, but to a payload scanner they are a fire alarm. The doctrine shift is subtle but real. The old advice was to design your governance so an attack cannot succeed. The new advice is to assume you will be targeted, and watch the mempool so you can respond when it happens.

The exchange as a circuit breaker

The other new line of defense sits at the edges, where tokens are bought and stolen funds are cashed out: the centralized exchange. In mid-August, Binance said its security team spotted a malicious proposal aimed at an unnamed DAO’s treasury of about $1.2 million and moved, with less than 48 hours before the proposal could execute, to coordinate deposit freezes with other exchanges and warn the project; the proposal was rejected and no funds were lost. (crypto.news) Binance did not name the DAO, the token, or the transaction, so the claim cannot be independently verified, and it should be read as the exchange’s account rather than confirmed fact. But the mechanism it describes is real and increasingly relevant.

Exchanges are choke points on both ends of the attack. On the way in, an attacker often has to route through exchange liquidity to accumulate a cheap governance token in size; on the way out, stolen treasury assets usually need an exchange to become spendable. That gives a cooperative venue two chances to intervene, freezing an attacker’s deposits before a vote or blacklisting the proceeds after. It is also a reminder that this trustless system leans on some very trusted intermediaries when things go wrong, the same tension that runs through every serious conversation about who really backstops DeFi.

A monitor is not a veto

A tripwire is not a wall. Every detection story this year comes with the same asterisk: the monitor tells you an attack is coming, but a monitor cannot stop it. Somebody, or some contract, still has to pull the brake in the hours the alarm buys. That is the piece most protocols are missing. A timelock with no empowered vetoer behind it is theater; an alert with no one on call is a notification nobody reads. The functioning version of the response layer looks like a guardian: a small, funded, accountable multisig or security council with the standing power to cancel a malicious proposal inside the timelock window, and the discipline to actually be watching. Getting that multisig right, who holds the keys, how they are secured, how a quorum acts under time pressure, is its own hard problem, one we covered in our guide to multisig best practices.

This is where the honest tension lives. As CryptoSlate put it in a September analysis, every emergency brake a DAO bolts on, registration requirements, staking locks, delegation, guardian vetoes, funnels practical control toward a small group of gatekeepers, recreating exactly the centralized authority the DAO was built to abolish. (CryptoSlate) A guardian that can veto an attacker’s proposal can also veto a legitimate one; a pause button that stops a theft can also freeze a change the holders actually wanted. There is no clean answer, only a choice about who you trust and when. The protocols that came through the summer best were not the most decentralized. They were the ones that had already decided, in advance, who was allowed to hit the brake.

The legal-but-hostile grey zone

Not every governance attack looks like a theft, and that is the uncomfortable frontier. Consider Compound’s Proposal 289 in July 2024, still the canonical case: a group moved 499,000 COMP, worth about $24 million at the time, into a vault they controlled, and it passed 682,191 votes to 633,636. What made it notable was the timing. Roughly 563,000 of the winning votes were cast in the final 34 minutes, the largest block landing eight minutes before the deadline, from addresses that had held only a few hundred COMP before a quiet four-month buildup. (CryptoSlate) Nothing was hacked. The vote was legal. Compound rescinded the outcome and later added a veto, but the episode showed how a determined minority can win inside the rules by simply out-waiting the clock.

That vulnerability is widespread. A 2026 analysis of 48 large Ethereum DAOs found seven that shared Compound’s exposure to last-minute vote concentration, among them Uniswap, Radicle, Gitcoin, Silo, Ampleforth, Hop, and Cryptex. (CryptoSlate) The same study counted 28 governance incidents, of which 16 used a DAO’s authorized processes to harm it, versus only six that leaned on an actual contract bug. This is the a16z indistinguishability problem playing out at the ballot box: when the weapon is a legitimate vote, the line between an attack and merely aggressive, self-interested governance is drawn after the fact, by who got hurt.

Is winning a vote a crime?

If an attacker follows the rules exactly, what law did they break? The question is not rhetorical. In May 2025, a US federal judge vacated the fraud and manipulation convictions of Avraham Eisenberg, who had drained about $110 million from Mango Markets in 2022, with the court reasoning in part that the exploited system was permissionless and self-executing. (CoinDesk) That logic hangs over every governance attack: if the code offered the action and the attacker merely took it, prosecutors are left arguing about intent and deception rather than pointing to a broken lock.

US regulators have not drawn a bright line. The SEC and the CFTC have both asserted authority over pieces of the DAO world, and enforcement has grown more active, a trend we track in our coverage of SEC crypto enforcement. But a governance attacker sitting behind a fresh address, having done nothing but buy tokens and vote, is a hard target: often anonymous, frequently offshore, and armed with the argument that they used the protocol as designed. The accountability gap is the point. When the machine does what it was told, the search for a defendant tends to end at a wallet nobody can name.

Why coin voting keeps handing over the keys

Strip away the incidents and the root cause is the voting model itself. Buterin’s 2021 critique still cuts to it: a governance token bundles two very different things, an economic stake in the protocol and the right to steer it, and “these two rights” are, in his words, “very easy to unbundle.” (vitalik.eth.limo) A flash loan, a rented delegation, or a short position lets someone hold the steering wheel without owning the car, so they can vote for an outcome that destroys the token’s value and lose nothing, or even profit, when it does. One-token-one-vote does not measure who cares about the protocol; it measures who can assemble the most tokens at the decisive moment.

And the tokens are already concentrated. The same 2026 study found that in 39 of the 48 DAOs it examined, the top ten holders controlled more than half the voting power; staking intermediaries dominate where they exist, with Convex commanding around 53% of Curve’s votes and Aura about 65% of Balancer’s. (CryptoSlate) That concentration is not a bug in the rollout; it is the resting state of token voting. Even governance’s biggest backers now say so out loud. “We spent the last 10 years rediscovering the hard way that direct democracy is a bad idea,” Ali Yahya, a general partner at a16z crypto, told Fortune this summer. (Fortune) Coming from one of the sector’s largest investors in on-chain governance, it is less an obituary than an admission that the naive version, one token, one vote, open treasury, has been fully priced by attackers.

How to tell if a protocol can survive a governance attack

You do not need to read Solidity to judge a protocol’s governance risk. A handful of questions, most answerable from a project’s docs or its governance forum, separate the hardened from the exposed. Before you hold a governance token or park assets in a DAO-controlled vault, work down this list.

• Does voting power snapshot from a past block? If it counts votes at proposal time, a flash loan can rent a majority for one block.
• Is there a real timelock, and, crucially, someone empowered and watching behind it? A delay with no vetoer is decoration.
• How expensive is a majority? High quorum and proposal-deposit thresholds raise the attacker’s bill; a thin float lowers it.
• Are the dangerous powers ring-fenced? Minting, treasury transfers, and contract upgrades should never be reachable by a single ordinary vote.
• Is anyone monitoring? Look for an on-chain monitor, a threat feed, or a guardian on call, not just a Discord channel.
• How concentrated is the token, and is that transparent? If ten wallets can pass anything, you are trusting ten wallets.
• Is the project alive? An abandoned DAO with a live Governor and a cheap token is a standing invitation, whatever it once was.

That last human factor is easy to underrate. Most malicious proposals hide in plain sight, a blank description here, an unfamiliar contract call there, and pass because no one reads the payload before delegating or voting, the same blind-approval habit that lets wallet drainers succeed. Tooling that surfaces what a transaction actually does, the kind we compared across the major wallets, is quietly part of the governance-defense stack too. The three layers below have to hold together; an attack only has to beat the weakest one.

2027: assume you will be targeted

The trajectory is clear enough to plan around. The attack side will keep industrializing, because the economics are settled: as long as governance tokens trade below the value they control and turnout stays thin, the a16z equation stays positive and someone will run it. Expect more automation on offense, scanners that hunt for underpriced governance across thousands of contracts, and more zombie DAOs picked off as their tokens decay. The defense side will professionalize in response. Detection is already commoditizing, with several firms racing to be the monitor of record; the harder work is the response layer, turning ad hoc guardian multisigs into a standard, funded, accountable role that every serious treasury staffs by default.

What will not save anyone is regulation, at least not soon. A protocol with no company behind it, no office, and no legal entity sits largely outside the reach of a securities regulator; the SEC can pursue people and registered firms, not a Governor contract voting to pay itself. That leaves the industry to secure itself, which is why the operative doctrine has flipped. Governance security in 2026 is not a box you tick at launch. It is an operating posture: assume your vote can be bought, assume you will be targeted, watch for it, and decide in advance who is allowed to pull the brake. The protocols still treating governance as a settled design choice are the ones writing next summer’s incident reports.

Frequently Asked Questions

What is a governance attack in crypto?

A governance attack is when someone acquires enough voting power in a token-based DAO to pass a proposal that serves them at the protocol’s expense, usually draining its treasury or seizing its admin keys. Nothing is hacked in the technical sense; the attacker uses the project’s own voting rules exactly as written, which is what makes the attack both legal-looking and hard to reverse.

How is a governance attack different from a hack?

A hack exploits a flaw in the code, a bug that lets an attacker do something the developers never intended. A governance attack exploits the code working perfectly: the votes are counted correctly and the proposal executes as designed. Because there is no bug, audits usually do not catch it, and the money often moves through the DAO’s own legitimate machinery.

Can a governance attack be reversed or the money recovered?

Rarely in full. Because the malicious transaction runs through the DAO’s own approved process, there is no bug to patch and no clean way to claw it back on-chain. Recovery usually depends on off-chain help, exchanges freezing stolen funds or law enforcement tracing them, and attackers often launder the proceeds through mixers first. Term Finance, for example, salvaged some lending positions but never recovered the drained crypto.

How are governance attacks detected before they execute?

Security firms run on-chain monitors that watch governance contracts for the signature of a hostile vote: a sudden concentration of voting power and an unusual proposal payload, such as a blank description or a call that reassigns admin rights. Monitors like Defimon and Blockaid simulate the transaction and raise an alarm during the timelock window, giving holders or a guardian time to vote the proposal down or veto it.

Is a governance attack illegal?

It is legally murky. In 2025 a US court vacated the convictions of the Mango Markets exploiter, reasoning partly that the system was permissionless and self-executing, which weakens the case that using it as designed is fraud. Attackers are also often anonymous and offshore. Regulators like the SEC can pursue people and registered firms, but a protocol with no legal entity behind it is hard to reach.

Anneke de Vries covers security and exploits for HOGE Wire.