Binance says it has blocked $1.2 million DAO governance attack

Binance helps stop malicious governance proposals, avoiding approximately US$1.2 million in losses

Binance said on August 18 that its security team helped prevent a malicious governance proposal that could have stolen approximately US$1.2 million in tokens from the vaults of an unnamed Decentralized Autonomous Organization (DAO).

Incident Summary

Binance said its security team detected a malicious governance proposal that threatened approximately $1.2 million in tokens. There are less than 48 hours left before the proposal is implemented. Binance contacted the organization and immediately coordinated with other centralized cryptocurrency exchanges to take preventive deposit closures. The organization voted down the proposal before it was implemented, and Binance reported that there were no financial losses. Binance did not disclose the organization's name, proposal identifier, nor did it provide on-chain transaction records.

Proposal to create vulnerability

The exchange said attackers tried to exploit vulnerabilities in the organization's on-chain governance mechanisms. Proposal creation has a low threshold, allowing attackers to circumvent expected protocol requirements. Binance did not explain what the requirements were or how the proposal would access the vault, and did not disclose whether the attacker accumulated governance tokens, borrowed voting rights, or hid malicious instructions in executable code.

Binance said on social media: "User protection is not just about defending our own platform, but also about strengthening the entire ecosystem to withstand attacks. Recently, our security team detected and helped stop a $1.2 million governance attack against a project agreement. This case demonstrates the importance of safe design."

Risks to governance mechanisms

The governance system allows token holders to vote on treasury expenditures, upgrades, and agreement settings. Attackers may gain control when the threshold for proposals is low, voting participation is low, or execution delays are so short that representatives have no time to respond. The voting process for the affected DAO provided enough time for intervention, but Binance said there were less than two days left. The exchange did not disclose the specific time for submission of the proposal and the exact implementation deadline.

Deposit closure reduction exit channel

After identifying the proposal, Binance contacted the organization and other exchanges where the token was placed. These platforms shut down deposits as a precautionary measure in case attackers try to transfer treasury tokens through centralized channels after the proposal is passed. Deposit closures will not by themselves prevent malicious proposals, but they will limit a potential way for attackers to sell, convert or launder money after the proposal is implemented.

In the end, the organization's community voted down the proposal. Binance did not say how many votes were against it, nor did it mention whether representatives had changed their previous positions or whether project managers had used emergency authority. Jimmy Su, Binance's chief security officer, said his team had identified a threat that "has not been flagged by an external security vendor." The claim has not been confirmed by unnamed groups or independent security companies.

Key details are missing and cannot be verified

The exchange did not disclose information on the project name, affected tokens, governance platforms or cooperative exchanges, nor did it disclose proposal identifiers, contract addresses, voting records or related blockchain transactions. These shortcomings make it impossible for outsiders to independently verify the US$1.2 million exposure and intervention timeline. Therefore, this figure should be regarded as an estimate of Binance rather than an independently determined amount of loss. In addition, since the assets affected were not disclosed, there was no identifiable reaction in the market. There were no transfers under the proposal, so this incident was an attempted attack rather than a completed treasury theft.

Prior to this incident, there were other attacks that used governance processes to obtain protocol assets. It was previously reported that attackers stole approximately $20 million from BonkDAO through malicious proposals. In another case, concerns about purchasing voting rights affecting DAO decisions suggest that low participation and delegated voting mechanisms may weaken governance protections without leveraging contract code.

Unnamed DAO still needs to be patched

The project requires changes to the rules that allow proposals to go to the voting stage. Possible control measures include raising proposals submission thresholds, extending lock-in periods, setting quorum requirements, and conducting independent reviews of actionable proposals. Emergency revocation can also prevent malicious behavior, but it introduces centralized control. Project parties must strike a balance between rapid intervention and a governance model that promises to token holders.

The exchange has not said whether the affected projects have completed these changes, nor has it announced whether it will release more technical details or disclose project identities after the immediate risk. A public post-mortem analysis report will allow users to confirm voting results, understand where the vulnerability lies, and assess whether the same vulnerability still exists. Prior to this, successful intervention and exposure of US$1.2 million were mainly based on Binance's unilateral statements.