1 article on this topic.
An attacker spent roughly $4.4M buying BONK to clear a 1% quorum, then pushed a malicious treasury proposal through a near-empty vote — no exploit, no bug, just governance math.