Who Owns the Game? Gaming DAOs and Governance Capture in 2026

On 24 October 2026, an attacker borrowed money they did not have, bought votes they did not believe in, and walked away with a treasury that was never theirs. The target was X100, a stablecoin protocol on Ethereum whose governance ran through a three-seat “Senate”: control two of the three seats and you control the money. The raider took an Aave flash loan of roughly $1.94 million in USDT, bought the X token, split it across two fresh contracts to seize two Senate seats in one transaction, and passed a proposal forcing the protocol to dump 400,000 X into a liquidity pool the attacker had built, with no minimum-output protection. The treasury received about $35. Minutes earlier those tokens had backed a market value near $760 million; by the end of the day X was worth around $24 million, a fall of more than 96%.

A day later, on 25 October, a protocol called Yapeswap lost about $21,900 when a proposal backed by roughly 0.000055% of its voting power handed a core permission to an attacker. Yapeswap’s governance required no minimum quorum, so almost nobody needed to agree. Two incidents, two days, two wildly different price tags, one identical lesson: when a protocol lets a vote move its money, the vote itself becomes the attack surface.

These raids are fast, atomic and easy to narrate because they happen inside a single block. But crypto’s deepest governance failures did not happen in a single block. They happened in slow motion, over years, in the one corner of the industry that was supposed to prove on-chain governance could work: gaming. Play-to-earn, guild DAOs and metaverse land councils were sold as the moment players would finally own the games they poured their lives into. Millions showed up. Then almost none of them voted, the tokens collapsed, and control drifted back to whoever held the keys. This is the story of how gaming became crypto’s largest and saddest experiment in community governance, and why the empty town hall it left behind is exactly what a raider like the X100 attacker goes shopping for.

The vote is the attack surface

A governance attack is not a hack in the ordinary sense. Nothing is broken. The attacker follows the rules exactly as written. In most decentralized protocols a governance token is two things at once, a financial asset and a ballot, and holding enough of it lets you propose and pass changes, including changes that move the treasury. If acquiring enough votes costs less than the value those votes can seize, the protocol is, quite literally, for sale.

Andreessen Horowitz’s crypto research team mapped this out in a 2022 paper that still reads like a blueprint. Their framing reduces the whole problem to a single inequality: an attack pays off when the value captured is greater than the cost of acquiring the voting power plus the cost of executing the attack. The authors described three ways in: buying votes openly, borrowing them for one block through a flash loan, or accumulating them quietly over weeks through wallets nobody is watching. X100 was the flash-loan version. BonkDAO, which lost roughly $20 million in July, was the quiet-accumulation version. The arithmetic is the same either way.

a16z also named the trap that makes these attacks so hard to prevent: indistinguishability. On an open market, a buyer accumulating tokens to raid a treasury looks identical to a buyer accumulating tokens because they are bullish. Both are willing to pay rising prices. The market cannot tell them apart until the malicious proposal is already on the ballot. Vitalik Buterin made a related point in 2021, arguing that a governance token is a bundle of two rights, an economic stake and a vote, and that the two are very easy to unbundle. A flash loan is precisely that unbundling: voting power for one block with no lasting economic exposure at all.

So ask which protocols have the cheapest votes relative to the value those votes control. The answer is any project whose token has collapsed while its treasury, brand or player base has not. That describes almost every gaming DAO in crypto.

Play to own: the pitch that pulled in millions

The promise was intoxicating, and for a while it worked. Axie Infinity turned a cartoon-monster battler into a genuine source of income for players across the Philippines, Venezuela and Indonesia during the pandemic. Yield Guild Games built a global guild that bought the expensive in-game NFTs and lent them to players who could not afford the entry ticket. Decentraland and its peers sold virtual land and handed governance of an entire world to the people who owned a piece of it. Bored Ape holders were given ApeCoin and a DAO to steer a brand that, at its peak, was mentioned in the same breath as luxury labels.

The pitch was always the same: you will not just play the game, you will help govern it, and you will share in the upside. It was community ownership with a token bolted on, and it recruited ordinary, non-crypto-native participants at a scale DeFi never approached. Many bought their first token on a mainstream exchange without ever realizing a vote came attached. Axie alone counted millions of daily users at its 2021 peak. This was the largest real-world test on-chain governance had ever been handed.

Four years on, the scoreboard is brutal. The tokens that were supposed to represent ownership have lost almost everything, and governance, where it still exists at all, has mostly been handed back to a studio, a foundation or a founder. The market has already priced the verdict.

Yield Guild Games: the guild that owned the assets

YGG was the clearest version of the dream and the clearest illustration of who actually held power. The guild raised capital, bought the Axie teams, virtual land and other NFTs that players needed to start earning, and ran a “scholarship” model: the guild owned the assets, a scholar played with them, and the rewards were split. At its peak that split ran roughly 70% to the scholar, 20% to a community manager and 10% to the guild, and the scholar base exploded from 241 players in February 2021 to more than 20,700 a year later.

Read that structure again and the governance question answers itself. The players generated the yield, but the guild owned the productive assets and the treasury, and the token holders at the top set the strategy. This was less a democracy of players than a landlord with a very large portfolio and a community of tenants. When the play-to-earn economies that fed it broke, the tenants had the least protection and the least say.

The human cost landed on the scholars. Many were players in emerging markets who treated Axie earnings as a real wage through 2021, and when Smooth Love Potion and the wider play-to-earn loop deflated, that income evaporated while the guild still held the underlying NFTs on its balance sheet. Governance tokens were meant to align everyone, yet the people with the most riding on the daily grind carried the least weight in the votes that set strategy. Ownership, it turned out, pooled upward.

YGG has spent 2026 quietly admitting the model is finished. Over the summer it shut down YGG Play, its game-publishing arm, and laid off 35 people, with co-founder Gabby Dizon calling the move a market decision, not a product decision. What survives has been rebranded YGG 3.0, a “sector-agnostic” infrastructure layer built around a Guild Protocol, with roughly 105 onchain guilds at launch and a plan to sell players’ behavioral data as training material for AI models. That pivot rides the same wave of crypto-AI infrastructure now reshaping the industry, and it is a long way from the founding promise that players would own the game.

Merit Circle versus YGG: a DAO expels its own investor

If YGG showed who owned the assets, Merit Circle showed what a DAO does when it decides an insider has become a liability. Merit Circle was a rival gaming guild that YGG had backed early, seeding it with 175,000 USDC in 2021. In May 2022 a Merit Circle contributor filed a proposal, remembered in the community as “HoneyBarrel,” to refund YGG’s investment, cancel its token allocation and sever the relationship, arguing the investor brought little value for its stake.

The DAO voted to cut YGG loose and ultimately bought out its position for about 1.75 million USDC, roughly ten times the original check, settling rather than heading to court. Depending on your sympathies, this was either a healthy community defending itself or a crowd using a vote to rewrite a deal it no longer liked. Either way it was the governance mechanism working exactly as designed, and producing an outcome an ordinary company’s shareholders could never have forced so fast. Merit Circle later rebranded to Beam and pivoted to running its own gaming chain, leaving the scholarship-guild era behind. A vote had become a tool for settling scores, which is only a short step from a vote becoming a tool for draining a treasury.

Axie and Sky Mavis: when it mattered, the studio decided

Axie Infinity is the case that should have settled the debate. When Axie’s in-game economy began to unravel in early 2022, the fix did not come from a community vote. The studio, Sky Mavis, cut the emissions of Smooth Love Potion, the game’s reward token, warning that it needed to take drastic and decisive action now or we risk total and permanent economic collapse. That was a central-bank decision made by a company, not a referendum of the players whose earnings it slashed overnight.

The point was hammered home weeks later. In March 2022 Axie’s Ronin bridge was drained of around $625 million in one of the largest crypto hacks ever recorded. Players did not vote on the response. Sky Mavis, backed by a Binance-led group, raised and deployed about $150 million to reimburse victims, a corporate rescue of a corporate failure. RON, the Ronin network token, now trades near $0.054, roughly 98.8% below its all-time high. When real money and real crises arrived, the keys were never in the crowd’s hands.

Decentraland: the empty town hall

Decentraland is the purest illustration of the apathy problem, because its DAO genuinely holds power. Holders of MANA, the virtual LAND parcels and in-world names vote on fees, policy and a real treasury. The machinery for player self-government exists and works. The players simply do not use it.

Turnout across DAOs is chronically low, and Decentraland has been fighting its own version of the problem in the open. In June 2026 the DAO voted to lower the voting-power threshold needed to pass proposals, from roughly six million down toward five million, precisely because too few votes were showing up to clear the bar. Consider what that means: the community’s answer to low participation was to make it easier for a smaller group to decide. MANA trades near $0.078, about 98.7% below its 2021 peak, and a thinly attended governance process sitting on a nine-figure treasury is exactly the profile an attacker reads as an opportunity.

ApeCoin votes to abolish itself

The most striking surrender came from ApeCoin. The ApeCoin DAO was created to let Bored Ape Yacht Club holders and APE owners steer a cultural juggernaut with a treasury worth hundreds of millions at its height. By 2025 it had become a byword for governance dysfunction. In June 2025 the DAO passed a proposal, AIP-596, to dissolve itself and transfer its assets, roughly $168 million, to a new entity called ApeCo controlled by Yuga Labs. It passed with roughly 99% support. The community, in other words, voted almost unanimously to hand power back to the founder.

Yuga Labs co-founder Greg Solano did not dress it up. He described the DAO as having devolved into “sluggish, noisy, and often unserious governance theater” that funneled money into “vanity proposals and low-impact initiatives.” APE trades near $0.12, about 99.5% below its 2022 high. It is hard to find a more honest epitaph for the play-to-own governance era than a founder calling the whole thing theater while the community agrees and votes to end the show.

The industry’s own backers have reached similar conclusions. Ali Yahya, a general partner at a16z crypto, told Fortune in 2026 that we spent the last 10 years rediscovering the hard way that direct democracy is a bad idea. Coming from one of crypto governance’s largest financiers, that is less a critique than a confession.

Pudgy Penguins: the players fired the founders, then a buyer saved it

Not every story is one of surrender, and Pudgy Penguins is the instructive counter-example. In January 2022 the Pudgy community turned on its own founding team over allegations of treasury mismanagement and effectively ousted them. This is community governance working the way the brochure promised: a crowd removing bad actors before they could do more damage.

But look at what actually rescued the project. It was not the DAO. It was Luca Netz, an entrepreneur who bought the collection, its intellectual property and its royalties for 750 ETH, around $2.5 million at the time, and rebuilt Pudgy Penguins into one of the strongest consumer brands in crypto, later launching the PENGU token. The lesson cuts against the dream: the community was good at firing people, but the turnaround came from concentrated ownership and a single accountable operator, not from a vote. Dispersed governance was good at saying no and poor at building anything.

A spectrum of capture

Line the gaming cases up and a pattern appears. Game-DAO power did not fail in a single way. It failed along a spectrum, from communities that wielded their votes aggressively to communities that never used them at all. What unites every point on that spectrum is that a broad base of players never ended up steering the game. The vote was captured, ignored or voluntarily surrendered, and sometimes all three in sequence.

At one end sits Merit Circle, a DAO wielding its vote like a weapon. In the middle sit YGG and Decentraland, where ownership was either concentrated or simply unused. At the other end sit Axie and ApeCoin, where power was openly returned to a studio or a founder. The dream was a flat community of player-owners. The reality was a hierarchy that reasserted itself the moment money or a crisis was on the line.

Why nobody shows up, and why that is dangerous

Underneath every one of these stories is the same structural rot, and it is measurable. A 2022 Chainalysis study of major DAOs found that across ten of them, less than 1% of holders controlled around 90% of the voting power. Turnout routinely sits in the single digits. Governance was pitched as one-token-one-vote democracy and delivered as plutocracy with a long tail of absentees who never cast a ballot at all.

Decentraland’s own fix is the clearest evidence of the disease. A DAO that lowers its passing threshold because not enough voting power turns up is admitting that the quorum it designed is unreachable in practice. Multiply that across dozens of game-DAOs whose tokens have cratered and whose Discord servers have emptied, and you get thousands of governance contracts sitting on real treasuries with almost nobody watching the door. An attacker does not need to beat an engaged electorate. In most of these games there is no engaged electorate to beat.

Gaming makes the problem worse in two specific ways. First, its communities are the least crypto-native in the industry, so the share of holders who can read a governance proposal, let alone inspect its calldata, is vanishingly small. Second, and more dangerously, its tokens have fallen hardest. When a governance token drops 99% but the brand, treasury or player base keeps its value, the cost of buying a controlling stake collapses with the price while the prize does not. That is the a16z equation tilting toward the attacker. Thin tokens are cheap votes, and gaming tokens are among the thinnest around. Liquidity that is thin by design, as Bitcoin’s Runes market shows in a very different context, is a convenience for anyone who wants to move a market quietly and a liability for everyone else holding the bag.

The concentration problem does not vanish when holders delegate their votes instead of casting them directly. It just moves. The same dynamic that lets a handful of large stakers dominate a liquid-staking protocol’s direction shows up in every token with a governance function, which is why the question of who really controls a protocol’s vote has become one of the most contested in crypto. In gaming, the honest answer is almost always: not the players.

The attack comes for the thin ones

This is where the slow-motion gaming story and the fast X100 raid meet. 2026 has been the year the governance attack industrialized. The security firm Blockaid counted at least seven governance takeovers between June and early August alone, draining around $22 million across Ethereum, Solana and Base. The roster is a catalogue of thin tokens. Token of Power, whose entire supply was about 16,384 units, let an attacker mint ten billion new tokens in a single transaction with no timelock. BonkDAO lost about $20 million after an attacker spent roughly $4.4 million to buy enough of a meme token to clear quorum in a seven-wallet vote.

Term Finance, in August, proved that defenses do not help if the token is cheap enough and nobody is watching. The attacker seeded the raid with about 2 ETH routed through a mixer, bought a controlling share of a thinly held governance token, and drained roughly 68% of the protocol’s vaults, about $8.5 million. Auditors PeckShield and CertiK were blunt that the exploit targeted the voting mechanics rather than any flaw in the underlying smart contract code. The code was fine. The electorate was the vulnerability.

X100 and Yapeswap in late October are simply the newest entries on a list that keeps growing. None of them required breaking a contract. Each needed a cheap token, a permissive governance process and an absent community, which is the exact profile a decade of play-to-earn produced at scale. The uncomfortable implication for gaming is that the capture which happened legally, through founder buyouts and self-dissolution, could just as easily happen violently, through a flash loan, to any game-DAO whose token is thin enough and whose holders are asleep.

Is capturing a DAO even a crime?

If an attacker only used the rules as written, did they break the law? Crypto’s courts have not produced a clean answer. The most-watched case, Avraham Eisenberg’s $110 million exploit of Mango Markets, ended with his crypto-fraud convictions vacated in May 2025, after a judge found the government had not proven its theory given that Mango’s contracts executed exactly as programmed. The ruling did not bless governance attacks, but it exposed how poorly traditional fraud statutes map onto the defense of “I used the smart contract as designed.”

Liability is just as murky. In 2023 the CFTC won a default judgment against the Ooki DAO, with a court agreeing the DAO was a person and an unincorporated association that could be fined, about $643,542, and held responsible for breaking the law. The message to token holders was chilling: vote in a DAO and you may be personally on the hook for what it does. In the United States the SEC and CFTC continue to circle digital-asset governance without a settled framework, which leaves the victims of a governance attack with little obvious recourse and ordinary participants with uncertain exposure.

The industry’s answer has been to wrap DAOs in real legal entities. Wyoming’s Decentralized Unincorporated Nonprofit Association statute, adopted in 2024, gives a DAO legal personhood and limited liability, and projects from Uniswap down have rushed to adopt it or a similar structure in the Marshall Islands. It is a telling retreat. The cure for the problems of leaderless governance turns out to be giving the organization a legal head after all, which is one more way of admitting the pure player-owned ideal did not hold.

What it means for players and holders

For anyone holding a gaming token for its governance rights, the honest starting assumption in 2026 is that those rights are decorative until proven otherwise. The patterns above repeat too reliably to ignore. Before you treat a vote as meaningful, or a token as a claim on anything, a handful of checks separate real governance from theater.

• Read the proposal, not the summary. Governance attacks hide in the calldata: a blank description, a call to setPendingAdmin, a treasury transfer to an unfamiliar address. If you cannot tell what a proposal actually executes, do not assume the crowd can either.
• Check concentration and turnout. If a few wallets hold most of the voting power, or if winning votes pass with single-digit participation, the community is a rounding error and the token’s governance is already captured, whether by a whale, a founder or a future attacker.
• Look for a timelock and an empowered veto. A delay between a vote passing and executing is the single most useful safeguard, but only if someone is actually watching and able to cancel. A timelock nobody monitors is, in Buterin’s phrase, more like a paywall on a newspaper website than a lock and key.
• Separate the brand from the token. A game can thrive while its governance token goes to zero, as Axie, Decentraland and ApeCoin all show. Owning the token rarely means owning the game.
• Watch where the real decisions happen. If emergencies, reimbursements and pivots are handled by a studio or foundation rather than a vote, that is where the power lives, whatever the DAO’s documents claim.

Gaming guilds themselves have largely accepted this. YGG’s reinvention as an infrastructure and AI-data layer, Merit Circle’s exit into its own chain, and ApeCoin’s self-dissolution are, in their different ways, admissions that a token-voting community of players was never going to run the thing. The experiment was real and the communities were real, which is what makes the conclusion so sobering: handing millions of people a token did not hand them the game. It mostly handed someone else a cheap way to take it.

For players, the practical takeaway is smaller and harder than the marketing ever admitted. A token can be a fun way to back a game you love, a speculative bet, or a membership badge. What it almost never is, in practice, is a steering wheel. Treat the vote as a bonus feature that occasionally matters rather than the thing you are buying, and the gaming-DAO era stops looking like a betrayal and starts looking like an expensive lesson the whole industry has now, mostly, absorbed.

Frequently Asked Questions

What is a governance attack in crypto?

A governance attack is when someone acquires enough of a protocol’s voting tokens to pass proposals that benefit them, usually draining the treasury, without breaking any code. The rules are used exactly as written. Attackers buy votes on the open market, borrow them for a single block with a flash loan as in the October 2026 X100 raid, or accumulate them quietly over weeks. It works whenever the cost of acquiring votes is less than the value those votes can seize.

Why are gaming DAOs especially vulnerable to governance attacks?

Gaming DAOs combine the three things an attacker wants: concentrated ownership, very low voter turnout, and tokens that have collapsed in price while the brand or treasury still holds value. When a governance token falls 99%, buying a controlling stake becomes cheap while the prize stays large. Communities that are mostly new to crypto are also unlikely to scrutinize a proposal, which makes the vote an easier target.

Did players ever really own the games through these DAOs?

Mostly no. In Yield Guild Games the guild owned the NFTs and treasury while players were effectively tenants. In Axie Infinity the studio, Sky Mavis, made the critical decisions, from cutting reward emissions to funding the $150 million reimbursement after the Ronin hack. ApeCoin holders voted in 2025 to dissolve their DAO and hand roughly $168 million back to Yuga Labs. Owning the token rarely meant owning or governing the game.

What happened to X100 in October 2026?

On 24 October 2026, an attacker used an Aave flash loan of about $1.94 million in USDT to seize two of the three seats in X100’s governance system in a single transaction, then passed a proposal forcing the treasury to sell 400,000 X tokens into a pool they controlled with no minimum-output protection. The treasury received about $35, and the X token’s market capitalization fell from around $760 million to about $24 million, a drop of more than 96%.

How can a token holder tell if a DAO’s governance is safe?

Check that proposals carry a timelock before execution and that an empowered security council or veto can actually cancel a malicious one. Look at voting concentration and turnout: if a few wallets dominate, or if votes pass with tiny participation, the governance is effectively captured. Read what a proposal executes, not just its title, and treat a collapsed gaming token’s voting rights as decorative until the project proves otherwise.

By Anneke de Vries, security and exploits correspondent, HOGE Wire.