DeFi Governance Attacks Are Now the Cheapest Exploit Class With Takeovers Starting at 1800 Dollars
Low voter turnout and purchasable voting power make DAO governance the highest-ROI attack vector in decentralised finance
The attack pattern is devastatingly simple. Most DAOs see just 5 to 15 per cent voter turnout, meaning an attacker needs to outbid essentially nobody to reach quorum. Once they have enough tokens, they submit a proposal to transfer admin control of protocol contracts to their own address.
Moonwell survived because it had implemented a "Break Glass Guardian" — a 2-of-3 emergency multisig that could veto malicious proposals. Most protocols lack this safeguard. GreenField DAO was not so fortunate: in April 2025, an attacker flash-borrowed 9 million governance tokens, passed a malicious proposal, and drained $31 million from the treasury within a single block.
The Beanstalk exploit of 2022, which used over $1 billion in flash-loaned tokens to steal $182 million, demonstrated the same fundamental vulnerability at even larger scale.
Security researchers have identified seven defence patterns that work, including vote escrow mechanisms that lock tokens before they can vote, time-weighted voting power, and emergency guardian multisigs. The challenge is that most protocols have not implemented any of them.
Analysis
Why This Matters
Governance attacks strike at the philosophical foundation of DeFi — the idea that decentralised governance is safer than centralised control. If a protocol can be hijacked for the price of a used car, that premise needs serious re-examination.
Background
The DAO governance model assumes broad, engaged participation from token holders. In practice, most token holders are passive investors who never vote, creating a structural vulnerability that attackers exploit.
Key Perspectives
Defenders of the DAO model argue that the solution is better governance design, not abandoning decentralisation. Critics counter that low participation is inherent to token-based governance and the model is fundamentally broken.
What to Watch
Whether the Moonwell incident and growing awareness of governance attacks leads to widespread adoption of defensive mechanisms, or whether protocols continue to launch with vulnerable governance structures.