An attacker exploited BonkDAO's token-weighted voting system, spending $4 million to pass a malicious proposal and steal $20 million in BONK tokens from the DAO's treasury.